registry / @sous-io/sous / 1.0.3
@sous-io/sous@1.0.3
Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and its executable is a user-invoked CLI for Sous’s stated configuration-compilation purpose. Scanner leads for credential redirection and command-output exfiltration were not confirmed in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The application runs when a user invokes the sous CLI.
Impact
No unauthorized credential collection, data exfiltration, or harmful default action was confirmed.
Mechanism
The CLI passes its arguments, working directory, and environment to the application command handler; repository and registry access support package features.
AI rationale
The manifest has no install lifecycle hook, and its executable is a user-invoked CLI for Sous’s stated configuration-compilation purpose. Scanner leads for credential redirection and command-output exfiltration were not confirmed in the inspected source.
Network endpoints3
registry.npmjs.orgapi.github.comraw.githubusercontent.com
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines a CLI entry point and lists no install lifecycle hooks.
- The CLI wrapper imports the application bundle; the bundle passes process arguments and environment to its command handler.
- The package description and bundled code identify Sous as a configuration compiler with repository and registry features.
Evidence against
- The bundle contains command execution and network access, but the reviewed excerpts show these as CLI and repository features; no malicious credential redirection or command-output exfiltration was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggeddist/sous.jsView file
731`));let versions=Object.keys(document.versions).filter(version2=>import_semver19.default.valid(version2)===version2).sort(import_semver19.default.rcompare),distTags={};for(let[tag,...
L732: `))}var import_semver19,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver19=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L733: `)}}function questionText(plan,title2,index,count2){return count2>1?`${questionFor(plan,title2)} (${index} of ${count2})`:questionFor(plan,title2)}async function handle4(input,ctx)...
...
L739: || (${dataType} === "string" && ${data} && ${data} == +${data} && !(${data} % 1))`).assign(coerced,(0,codegen_1._)`+${data}`);return;case"boolean":gen.elseIf((0,codegen_1._)`${data...
L740: || ${dataType} === "boolean" |
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/sous.jsView on unpkg · L731727`)?`
L728: `:"";return{file:file2,contents:JSON.stringify({...pkg,devDependencies},null,indent2)+newline,outcome:{kind:"added",section:"devDependencies",range:version2}}}var init_package_json...
L729: `).map(line=>` ${line}`)],cause:error51})}}var IGNORE_BLOCK_LINES,init_scaffold2=__esm({"../plugin-init/src/scaffold.ts"(){"use strict";init_package_json();init_templates2();IGNOR...
...
L731: `));let versions=Object.keys(document.versions).filter(version2=>import_semver19.default.valid(version2)===version2).sort(import_semver19.default.rcompare),distTags={};for(let[tag,...
L732: `))}var import_semver19,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver19=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L733: `)}}function questi
Findings
4 Critical6 High4 Medium5 Low
CriticalSame File Env Network Executiondist/sous.js
CriticalCommand Output Exfiltrationdist/sous.js
CriticalDownload Executedist/sous.js
CriticalTrigger Reachable Dangerous Capabilitydist/sous.js
HighChild Processdist/sous.js
HighShell
HighEvaldist/sous.js
HighCredential Redirect Persistencedist/sous.js
HighTrigger Reachable Command Output Exfiltrationdist/sous.js
HighSemantic Analysis Limiteddist/sous.js
MediumDynamic Requiredist/sous.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @sous-io/sous@1.0.3.
See all versions of @sous-io/sous for other recorded verdicts.
- Review the evidence and your use of @sous-io/sous@1.0.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.