registry / @sous-io/sous / 1.0.15
@sous-io/sous@1.0.15
Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates
AI Security Review
scanned 4h ago · by lpm-firewall-aiThe manifest has no install-time lifecycle hook, and the CLI entrypoint passes user arguments into the command-line application. The scanner's dangerous-capability leads were not substantiated as automatic credential redirection, command-output exfiltration, or concealed download-and-execute behavior in the reviewed excerpts.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The bundled CLI runs when a user invokes the sous command with arguments.
Impact
No automatic credential theft, command-output exfiltration, or concealed remote-code execution was established in the inspected source.
Mechanism
It uses local processes and network access for its CLI operations, including Git-based recipe downloads and repository or registry requests.
AI rationale
The manifest has no install-time lifecycle hook, and the CLI entrypoint passes user arguments into the command-line application. The scanner's dangerous-capability leads were not substantiated as automatic credential redirection, command-output exfiltration, or concealed download-and-execute behavior in the reviewed excerpts.
Evidence
package.jsondist/bin.jsdist/sous.js
Network endpoints3
github.comregistry.npmjs.orguser-configured repository hosts
Decision evidence
public snapshotAI called this Clean at 81.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has no install, preinstall, or postinstall hook.
- The CLI loads the bundle, which dispatches using the user's arguments and working directory.
- The bundled process runner executes commands as part of the CLI's operations; the reviewed source does not establish automatic command-output exfiltration.
- The source describes Git-based recipe downloads and uses HTTP for repository reads and npm registry metadata.
Evidence against
- The CLI reads process environment and can run child processes, so its intended operations can access local machine data and tools.
- The bundle is large and minified, limiting review of its complete behavior.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
12 flaggeddist/sous.jsView file
733`));let versions=Object.keys(document.versions).filter(version2=>import_semver20.default.valid(version2)===version2).sort(import_semver20.default.rcompare),distTags={};for(let[tag,...
L734: `))}var import_semver20,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver20=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L735: `)}}function questionText(plan,title2,index,count2){return count2>1?`${questionFor(plan,title2)} (${index} of ${count2})`:questionFor(plan,title2)}async function handle4(input,ctx)...
...
L741: || (${dataType} === "string" && ${data} && ${data} == +${data} && !(${data} % 1))`).assign(coerced,(0,codegen_1._)`+${data}`);return;case"boolean":gen.elseIf((0,codegen_1._)`${data...
L742: || ${dataType} === "boolean" |
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/sous.jsView on unpkg · L733729`)?`
L730: `:"";return{file:file2,contents:JSON.stringify({...pkg,devDependencies},null,indent2)+newline,outcome:{kind:"added",section:"devDependencies",range:version2}}}var init_package_json...
L731: `).map(line=>` ${line}`)],cause:error51})}}var IGNORE_BLOCK_LINES,init_scaffold2=__esm({"../plugin-init/src/scaffold.ts"(){"use strict";init_package_json();init_templates2();IGNOR...
...
L733: `));let versions=Object.keys(document.versions).filter(version2=>import_semver20.default.valid(version2)===version2).sort(import_semver20.default.rcompare),distTags={};for(let[tag,...
L734: `))}var import_semver20,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver20=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L735: `)}}function questi
Findings
4 Critical6 High5 Medium5 Low
CriticalSame File Env Network Executiondist/sous.js
CriticalCommand Output Exfiltrationdist/sous.js
CriticalDownload Executedist/sous.js
CriticalTrigger Reachable Dangerous Capabilitydist/sous.js
HighChild Processdist/sous.js
HighShell
HighEvaldist/sous.js
HighCredential Redirect Persistencedist/sous.js
HighTrigger Reachable Command Output Exfiltrationdist/sous.js
HighSemantic Analysis Limiteddist/sous.js
MediumDynamic Requiredist/sous.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @sous-io/sous@1.0.15.
See all versions of @sous-io/sous for other recorded verdicts.
- Review the evidence and your use of @sous-io/sous@1.0.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.