registry / @punks/cli / 5.2.1
@punks/cli@5.2.1
⚠ Under reviewHarness Intelligence scaffolding CLI
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspection found a user-invoked scaffolding CLI with no install lifecycle, no self-dependency, and no hidden exfiltration chain. mark_clean is unavailable because required citation coverage exceeds the eight-citation limit, and that limit alone is not attack evidence.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
No install or import trigger was identified. Code runs when a user invokes the hi or hint binary or a bundled skill script.
Impact
No confirmed unconsented mutation, credential theft, or remote payload execution was established from the inspected entrypoints.
Mechanism
Lifecycle scripts are absent. Child-process use and harness-directory writes are inside the CLI and skill helpers and run after an explicit user command.
AI rationale
Inspection found a user-invoked scaffolding CLI with no install lifecycle, no self-dependency, and no hidden exfiltration chain. mark_clean is unavailable because required citation coverage exceeds the eight-citation limit, and that limit alone is not attack evidence.
Decision evidence
public snapshotAI called this Manual Review at 66.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json 5.2.1 exposes bin entries hi and hint at dist/index.js and defines no preinstall, install, or postinstall script.
- The only runtime dependency is react-devtools-core; the package does not depend on its own name.
- dist/index.js is a node CLI shebang bundle, so execution starts when a user runs hi or hint.
- Required clean citation coverage lists 11 paths while sourceCitations allows at most 8, so a clean decision cannot be finalized.
Evidence against
- No install-time hook, eval, remote payload fetch, or credential send sink was found on the package entrypoint.
- Agent directory writes and git or shell helpers sit in user-invoked scaffold and skill scripts, aligned with the scaffolding CLI purpose.
- Registry and GitHub URLs in the bundle are version checks and the published skills source, not an install-time exfiltration path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
20 flaggeddist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from "node:child_process";
L3: import { existsSync, readdirSync, statSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjsView on unpkg · L1dist/index.jsView file
1315`).some((line)=>{const command=line.trim();return command.length>0&&!command.startsWith("#")&&(/^(?:(?:command|exec)\s+)?lefthook\s+run\s+["']?pre-commit["']?(?:\s|$)/u.test(comman...
L1316: `,"utf-8");return verification};var commitGateVerifyCommandMetadata=declareCommandMetadata({examples:[{command:"hi commit-gate verify",summary:"Verify the installed Commit Gate."}]...
L1317:
High
Findings
1 Critical14 High8 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/baseline/scaffold-baseline/data/scripts/commit-gate-runner.mjs
HighChild Processdist/baseline/scaffold-baseline/skills/misc/timesheet/scripts/git-timesheet-evidence.mjs
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighObfuscated Payload Loaderdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighShips High Entropy Blobdist/baseline/scaffold-baseline.tgz
HighKnown Malware Source Similaritydist/baseline/scaffold-baseline/skills/frameworks/expo/expo-skill-eval/scripts/snapshot-android.sh
Affected versions and remediation
This report applies to @punks/cli@5.2.1.
See all versions of @punks/cli for other recorded verdicts.
- Review the evidence and your use of @punks/cli@5.2.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.