@sous-io/sous@1.0.2
Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe bundle has a credential forwarding flaw: it follows cross-origin redirects while retaining the repository token header. This is a serious vulnerability in repository fetching, though the source does not show a fixed malicious collector or deliberate credential theft.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a command that fetches a repository requiring authentication, and the repository host responds with a redirect to another origin.
Impact
A redirecting host can cause the user's repository credential to be sent to a foreign host.
Mechanism
The fetch code follows the Location URL while reusing the original request headers, including the Bearer token, without validating the redirect origin.
AI rationale
The bundle has a credential forwarding flaw: it follows cross-origin redirects while retaining the repository token header. This is a serious vulnerability in repository fetching, though the source does not show a fixed malicious collector or deliberate credential theft.
Evidence
dist/sous.js
Network endpoints3
api.github.com${repository.host}/api/v3Redirect URL derived from the response Location header
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The HTTP read strategy adds a repository token as a Bearer Authorization header.
- Each redirect request reuses the same headers, including the Authorization header.
- Redirect destinations are taken from the response Location without checking that the origin stays the same.
- GitHub repository reads can obtain tokens from environment variables, Git credentials, or the GitHub CLI.
Evidence against
- The package describes itself as a CLI for compiling AI agent configuration and has no install or postinstall hook.
- Fetching configured repositories with their credentials is consistent with the package’s purpose; the issue is that credentials can carry across redirects.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
11 flaggeddist/sous.jsView file
731`));let versions=Object.keys(document.versions).filter(version2=>import_semver19.default.valid(version2)===version2).sort(import_semver19.default.rcompare),distTags={};for(let[tag,...
L732: `))}var import_semver19,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver19=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L733: `)}}function questionText(plan,title2,index,count2){return count2>1?`${questionFor(plan,title2)} (${index} of ${count2})`:questionFor(plan,title2)}async function handle4(input,ctx)...
...
L739: || (${dataType} === "string" && ${data} && ${data} == +${data} && !(${data} % 1))`).assign(coerced,(0,codegen_1._)`+${data}`);return;case"boolean":gen.elseIf((0,codegen_1._)`${data...
L740: || ${dataType} === "boolean" |
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/sous.jsView on unpkg · L731727`)?`
L728: `:"";return{file:file2,contents:JSON.stringify({...pkg,devDependencies},null,indent2)+newline,outcome:{kind:"added",section:"devDependencies",range:version2}}}var init_package_json...
L729: `).map(line=>` ${line}`)],cause:error51})}}var IGNORE_BLOCK_LINES,init_scaffold2=__esm({"../plugin-init/src/scaffold.ts"(){"use strict";init_package_json();init_templates2();IGNOR...
...
L731: `));let versions=Object.keys(document.versions).filter(version2=>import_semver19.default.valid(version2)===version2).sort(import_semver19.default.rcompare),distTags={};for(let[tag,...
L732: `))}var import_semver19,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver19=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L733: `)}}function questi
Findings
4 Critical6 High4 Medium5 Low
CriticalSame File Env Network Executiondist/sous.js
CriticalCommand Output Exfiltrationdist/sous.js
CriticalDownload Executedist/sous.js
CriticalTrigger Reachable Dangerous Capabilitydist/sous.js
HighChild Processdist/sous.js
HighShell
HighEvaldist/sous.js
HighCredential Redirect Persistencedist/sous.js
HighTrigger Reachable Command Output Exfiltrationdist/sous.js
HighSemantic Analysis Limiteddist/sous.js
MediumDynamic Requiredist/sous.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @sous-io/sous@1.0.2.
See all versions of @sous-io/sous for other recorded verdicts.
- Review the evidence and your use of @sous-io/sous@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.