registry / @reddoorla/maintenance / 0.65.1

@reddoorla/maintenance@0.65.1

Canonical maintenance configs, audits, and recipes for the reddoor stack.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The risky primitives are explicit CLI maintenance/reporting capabilities for Reddoor sites, not install-time or import-time malware.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs reddoor-maint commands or imports exported library functions.

Impact

Can intentionally mutate target repos, install dependencies, run audits, send reports, and update GitHub/Netlify/Airtable/Resend state when invoked with credentials.

Mechanism

User-invoked maintenance automation with subprocesses, project file writes, and service API calls.

Rationale

Static inspection shows an operator maintenance CLI with documented, user-invoked repo mutation and service API integrations, but no lifecycle execution, hidden payload, unrelated exfiltration, persistence, or AI-agent control-surface tampering. Scanner findings are explained by legitimate audits/recipes/reporting features.

Evidence

package.jsonREADME.mddist/cli/bin.jsdist/chunk-6VAL7XJT.jsdist/chunk-HVOOCK6L.jsdist/chunk-ZYBOT5PM.jsdist/chunk-4NAOR44V.jsdist/chunk-PBDZGBGL.jsdist/chunk-IRRZG66U.jsdist/chunk-FH7WQHD7.js~/.config/reddoor-maint/credentials.envpnpm-lock.yaml.github/workflows/ci.yml.github/workflows/renovate.ymlrenovate.jsonsrc/routes/dev/a11y-fixtures/+page.sveltereports/<slug>/draft.html

Network endpoints6

content.airtable.com/v0/api.github.comapi.netlify.com/api/v1/www.googleapis.com/auth/analytics.readonlysearchconsole.googleapis.com/webmasters/v3resend.com/webhooks

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/cli/bin.js calls loadCredentialsIntoEnv() on CLI startup, reading ~/.config/reddoor-maint/credentials.env into process.env.
dist/chunk-FH7WQHD7.js dynamically imports user-supplied .js/.mjs fleet inventory files when --fleet is used.
dist/chunk-ZYBOT5PM.js and dist/chunk-D3DQFC32.js run pnpm install/up during explicit maintenance recipes.
dist/chunk-IRRZG66U.js can write CI/Renovate files, open PRs, and set RENOVATE_TOKEN via GitHub CLI during self-updating command.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; bin is explicit reddoor-maint CLI.
README.md documents the same audits, recipes, Airtable/Resend reporting, GitHub/Netlify integrations, and mutation behavior.
dist/chunk-HVOOCK6L.js uses child_process.spawn with argument arrays, not shell command strings.
Network use is aligned to documented services: Airtable, Resend, GitHub, Netlify, Google APIs, and user-provided site URLs.
Credential reads are used as API credentials for package-aligned operations; no source path shows bulk env harvesting or exfiltration to an unrelated host.
dist/chunk-4NAOR44V.js validates repo names/URLs and uses git clone -- to reduce argv injection risk.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 86 file(s), 407 KB of source, external domains: api.github.com, api.netlify.com, content.airtable.com, developer.chrome.com, docs.renovatebot.com, github.com, images.prismic.io, player.vimeo.com, reddoor-maintenance.netlify.app, searchconsole.googleapis.com, static.cdn.prismic.io, www.googleapis.com, x.invalid

Source & flagged code

4 flagged

dist/chunk-4NAOR44V.jsView file

Lines 31-71javascript

31 throw new Error(

32 `unsafe repoUrl: must start with a scheme (https://, ssh://, git://, file://) or use scp-style "user@host:path" (got: ${JSON.stringify(repoUrl)})`

33 );

34 }

35}

36async function isNonEmptyDir(path) {

37 try {

38 const s = await stat(path);

39 if (!s.isDirectory()) return false;

40 const entries = await readdir(path);

41 return entries.length > 0;

42 } catch {

43 return false;

44 }

45}

46function expectedRepoRef(site) {

47 return site.gitRepo ?? site.repoUrl ?? void 0;

48}

49async function assertCheckoutMatches(site, path, spawn) {

50 const expected = expectedRepoRef(site);

51 if (!expected) return;

52 const r = await spawn("git", ["-C", path, "remote", "get-url", "origin"], {

53 timeoutMs: 3e4

High

Child Process

Package source references child process execution.

dist/chunk-4NAOR44V.jsView on unpkg · L51

54 });

55 if (r.code !== 0) return;

56 const origin = r.stdout.trim();

57 if (origin.length === 0) return;

58 if (!sameOwnerRepo(origin, expected)) {

59 throw new Error(

60 `checkout at ${path} is the wrong repo: origin is ${JSON.stringify(origin)} but site expects ${JSON.stringify(expected)} (slug collision?) \u2014 refusing to reuse it`

61 );

62 }

63}

64var GIT_REPO_RE = /^[\w.-]+\/[\w.-]+$/;

65function resolveCloneUrl(site) {

66 if (site.repoUrl) return site.repoUrl;

67 if (!site.gitRepo) return void 0;

68 if (!GIT_REPO_RE.test(site.gitRepo)) {

69 throw new Error(`unsafe gitRepo: expected "owner/repo" (got: ${JSON.stringify(site.gitRepo)})`);

70 }

71 return `https://github.com/${site.gitRepo}.git`;

dist/chunk-FH7WQHD7.jsView file

Lines 11-51javascript

11import { resolve, extname } from "path";

12function sanitizeDynamicSites(sites) {

13 return sites.map((s) => {

14 if (s.deployedUrl !== void 0 && !isHttpUrl

dist/chunk-PBDZGBGL.jsView file

Lines 14-54javascript

14 "Domain, DNS & SSL",

15 "Google Indexed",

16 "Security Updates",

17 "Uptime Checked"

18 ],

19 testingIntro: "Testing includes checks similar to those at launch: testing on common browsers and operating systems, at different screen sizes, and checking every function, and updating all packages for performance rather than just those needed for security.",

20 testingChecklist: [

dist/chunk-ZYBOT5PM.jsView file

Lines 111-151javascript

111 }

112 for (const audit of audits) {

113 for (const dep of AUDIT_DEPS[audit]) {

114 if (!isDeclared(pkg, dep.name)) toAdd.push(dep);

115 }

Source & flagged code

4 flagged · loading source

dist/chunk-4NAOR44V.jsView file

51if (!expected) return; L52: const r = await spawn("git", ["-C", path, "remote", "get-url", "origin"], { L53: timeoutMs: 3e4

High

Child Process

Package source references child process execution.

dist/chunk-4NAOR44V.jsView on unpkg · L51

dist/chunk-FH7WQHD7.jsView file

31if (input.fleet === "airtable") { L32: const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js"); L33: const { fromAirtableBase } = await import("./airtable-GGZJUGQB.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-FH7WQHD7.jsView on unpkg · L31

dist/chunk-PBDZGBGL.jsView file

34launchHeading: "LAUNCHED", L35: launchBody: "Your site is live. We've set it up on the Reddoor stack with hosting, security, and automatic maintenance so it stays fast and healthy. Here's what's in place:", L36: launchSetupItems: [ ... L174: <mj-text color="${RED}" font-size="20px" font-weight="700" padding-top="${labelTop}">LIGHTHOUSE SCORES*</mj-text>${rows} L175: <mj-text color="${GREY}" font-family="helvetica, sans-serif" font-size="12px" font-weight="300" padding-top="24px" padding-bottom="${footnoteBottom}" line-height="20px">*A Lighthou... L176: </mj-column> ... L554: const start = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0; L555: const head = Buffer.from(bytes.slice(start, start + 64)).toString("ascii").replace(/^[\s]+/, "").toLowerCase(); L556: return head.startsWith("<!doctype html") || head.startsWith("<html") || head.startsWith("<head"); ... L576: async function uploadAttachment(recordId, fieldName, body, filename, contentType) { L577: const apiKey = process.env.AIRTABLE_PAT; L578: const baseId = process.env.AIRTABLE_BASE_ID;

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/chunk-PBDZGBGL.jsView on unpkg · L34

dist/chunk-ZYBOT5PM.jsView file

131await writePackageJson(pkgPath, next); L132: const installResult = await spawn("pnpm", ["install"], { cwd, streaming: true }); L133: if (installResult.code !== 0) { ... L135: kind: "failed", L136: notes: `pnpm install failed (exit ${installResult.code})` L137: };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-ZYBOT5PM.jsView on unpkg · L131

Findings

4 High4 Medium5 Low

HighChild Processdist/chunk-4NAOR44V.js

HighShell

HighCredential Exfiltrationdist/chunk-PBDZGBGL.js

HighRuntime Package Installdist/chunk-ZYBOT5PM.js

MediumDynamic Requiredist/chunk-FH7WQHD7.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/chunk-4NAOR44V.jsView file

Lines 31-71javascript

31 throw new Error(

32 `unsafe repoUrl: must start with a scheme (https://, ssh://, git://, file://) or use scp-style "user@host:path" (got: ${JSON.stringify(repoUrl)})`

33 );

34 }

35}

36async function isNonEmptyDir(path) {

37 try {

38 const s = await stat(path);

39 if (!s.isDirectory()) return false;

40 const entries = await readdir(path);

41 return entries.length > 0;

42 } catch {

43 return false;

44 }

45}

46function expectedRepoRef(site) {

47 return site.gitRepo ?? site.repoUrl ?? void 0;

48}

49async function assertCheckoutMatches(site, path, spawn) {

50 const expected = expectedRepoRef(site);

51 if (!expected) return;

52 const r = await spawn("git", ["-C", path, "remote", "get-url", "origin"], {

53 timeoutMs: 3e4

High

Child Process

Package source references child process execution.

dist/chunk-4NAOR44V.jsView on unpkg · L51

54 });

55 if (r.code !== 0) return;

56 const origin = r.stdout.trim();

57 if (origin.length === 0) return;

58 if (!sameOwnerRepo(origin, expected)) {

59 throw new Error(

60 `checkout at ${path} is the wrong repo: origin is ${JSON.stringify(origin)} but site expects ${JSON.stringify(expected)} (slug collision?) \u2014 refusing to reuse it`

61 );

62 }

63}

64var GIT_REPO_RE = /^[\w.-]+\/[\w.-]+$/;

65function resolveCloneUrl(site) {

66 if (site.repoUrl) return site.repoUrl;

67 if (!site.gitRepo) return void 0;

68 if (!GIT_REPO_RE.test(site.gitRepo)) {

69 throw new Error(`unsafe gitRepo: expected "owner/repo" (got: ${JSON.stringify(site.gitRepo)})`);

70 }

71 return `https://github.com/${site.gitRepo}.git`;

dist/chunk-FH7WQHD7.jsView file

Lines 11-51javascript

11import { resolve, extname } from "path";

12function sanitizeDynamicSites(sites) {

13 return sites.map((s) => {

14 if (s.deployedUrl !== void 0 && !isHttpUrl

dist/chunk-PBDZGBGL.jsView file

Lines 14-54javascript

14 "Domain, DNS & SSL",

15 "Google Indexed",

16 "Security Updates",

17 "Uptime Checked"

18 ],

20 testingChecklist: [

dist/chunk-ZYBOT5PM.jsView file

Lines 111-151javascript

111 }

112 for (const audit of audits) {

113 for (const dep of AUDIT_DEPS[audit]) {

114 if (!isDeclared(pkg, dep.name)) toAdd.push(dep);

115 }