registry / @sous-io/sous / 1.0.14
@sous-io/sous@1.0.14
Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged bundle’s inspected token flow uses a repository host service rather than a fixed unrelated collector. The package’s execution, file access, and network use fit its stated CLI purpose; the routing hints alone do not establish an attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Invoking the sous CLI imports the bundle and starts the application with the supplied command-line arguments.
Impact
Expected CLI operations may read or write project configuration and communicate with selected repository hosts; inspected evidence did not establish credential theft or concealed remote execution.
Mechanism
The bundle performs command-dependent filesystem, subprocess, and network operations. Inspected token handling uses a repository host HTTP service.
AI rationale
The manifest has no install lifecycle hook, and the flagged bundle’s inspected token flow uses a repository host service rather than a fixed unrelated collector. The package’s execution, file access, and network use fit its stated CLI purpose; the routing hints alone do not establish an attack.
Evidence
dist/bin.jsdist/sous.jspackage.json
Network endpoints3
github.comapi.github.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has no install, preinstall, or postinstall script.
- The CLI imports the main bundle, which runs the command-line application with the current arguments and working directory.
- The bundle’s bearer-token code reads a repository through its configured host HTTP service; the inspected excerpt shows no fixed credential-collection destination.
- The prepared runtime dependency entry point exports plugin interfaces and types.
Evidence against
- The bundle uses environment variables, filesystem writes, subprocesses, and network access as part of a CLI for building agent configuration and managing repositories.
- The bundle includes an import-time CLI startup path, so behavior depends on the command invoked.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
12 flaggeddist/sous.jsView file
733`));let versions=Object.keys(document.versions).filter(version2=>import_semver20.default.valid(version2)===version2).sort(import_semver20.default.rcompare),distTags={};for(let[tag,...
L734: `))}var import_semver20,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver20=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L735: `)}}function questionText(plan,title2,index,count2){return count2>1?`${questionFor(plan,title2)} (${index} of ${count2})`:questionFor(plan,title2)}async function handle4(input,ctx)...
...
L741: || (${dataType} === "string" && ${data} && ${data} == +${data} && !(${data} % 1))`).assign(coerced,(0,codegen_1._)`+${data}`);return;case"boolean":gen.elseIf((0,codegen_1._)`${data...
L742: || ${dataType} === "boolean" |
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/sous.jsView on unpkg · L733729`)?`
L730: `:"";return{file:file2,contents:JSON.stringify({...pkg,devDependencies},null,indent2)+newline,outcome:{kind:"added",section:"devDependencies",range:version2}}}var init_package_json...
L731: `).map(line=>` ${line}`)],cause:error51})}}var IGNORE_BLOCK_LINES,init_scaffold2=__esm({"../plugin-init/src/scaffold.ts"(){"use strict";init_package_json();init_templates2();IGNOR...
...
L733: `));let versions=Object.keys(document.versions).filter(version2=>import_semver20.default.valid(version2)===version2).sort(import_semver20.default.rcompare),distTags={};for(let[tag,...
L734: `))}var import_semver20,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver20=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L735: `)}}function questi
Findings
4 Critical6 High5 Medium5 Low
CriticalSame File Env Network Executiondist/sous.js
CriticalCommand Output Exfiltrationdist/sous.js
CriticalDownload Executedist/sous.js
CriticalTrigger Reachable Dangerous Capabilitydist/sous.js
HighChild Processdist/sous.js
HighShell
HighEvaldist/sous.js
HighCredential Redirect Persistencedist/sous.js
HighTrigger Reachable Command Output Exfiltrationdist/sous.js
HighSemantic Analysis Limiteddist/sous.js
MediumDynamic Requiredist/sous.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @sous-io/sous@1.0.14.
See all versions of @sous-io/sous for other recorded verdicts.
- Review the evidence and your use of @sous-io/sous@1.0.14 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.