registry / @sous-io/sous / 1.0.7
@sous-io/sous@1.0.7
Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the bundle's examined credential and network code supports user-invoked repository operations. The flagged scanner findings were not confirmed in the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The bundle runs when the user invokes the sous CLI.
Impact
No malicious credential redirection, command-output exfiltration, or install-time contact was identified in the inspected source.
Mechanism
The examined credential flow obtains tokens for repository access and uses them in the repository HTTP read strategy; startup metadata is stored locally.
AI rationale
The manifest has no install lifecycle hooks, and the bundle's examined credential and network code supports user-invoked repository operations. The flagged scanner findings were not confirmed in the inspected source.
Evidence
sous local cache startup record
Network endpoints2
registry.npmjs.orgGitHub and other configured repository hosts
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest defines a CLI entry point at dist/bin.js and has no install, preinstall, or postinstall hook.
- The CLI imports the bundle when the user runs the sous command.
- Credential handling is implemented as repository token sources, including environment variables and git credential fill.
- The HTTP read strategy uses a token only when the strategy requires it, then forms an Authorization header for the repository read.
- The startup record is written under sous's local cache directory; no outbound reporting appears in the startup code examined.
Evidence against
- The bundle includes child-process execution and network functionality, but examined paths use them for CLI and repository operations consistent with the package's purpose.
- The static scanner reported credential redirection and command-output exfiltration, but the inspected source did not substantiate those behaviors.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEval
Source & flagged code
13 flaggeddist/sous.jsView file
732`));let versions=Object.keys(document.versions).filter(version2=>import_semver19.default.valid(version2)===version2).sort(import_semver19.default.rcompare),distTags={};for(let[tag,...
L733: `))}var import_semver19,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver19=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L734: `)}}function questionText(plan,title2,index,count2){return count2>1?`${questionFor(plan,title2)} (${index} of ${count2})`:questionFor(plan,title2)}async function handle4(input,ctx)...
...
L740: || (${dataType} === "string" && ${data} && ${data} == +${data} && !(${data} % 1))`).assign(coerced,(0,codegen_1._)`+${data}`);return;case"boolean":gen.elseIf((0,codegen_1._)`${data...
L741: || ${dataType} === "boolean" |
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/sous.jsView on unpkg · L732728`)?`
L729: `:"";return{file:file2,contents:JSON.stringify({...pkg,devDependencies},null,indent2)+newline,outcome:{kind:"added",section:"devDependencies",range:version2}}}var init_package_json...
L730: `).map(line=>` ${line}`)],cause:error51})}}var IGNORE_BLOCK_LINES,init_scaffold2=__esm({"../plugin-init/src/scaffold.ts"(){"use strict";init_package_json();init_templates2();IGNOR...
...
L732: `));let versions=Object.keys(document.versions).filter(version2=>import_semver19.default.valid(version2)===version2).sort(import_semver19.default.rcompare),distTags={};for(let[tag,...
L733: `))}var import_semver19,NEWEST_LISTED,init_versions2=__esm({"../plugin-update/src/versions.ts"(){"use strict";import_semver19=__toESM(require_semver2(),1),NEWEST_LISTED=5}});functi...
L734: `)}}function questi
Findings
5 Critical6 High5 Medium5 Low
CriticalSame File Env Network Executiondist/sous.js
CriticalCommand Output Exfiltrationdist/sous.js
CriticalDownload Executedist/sous.js
CriticalTrigger Reachable Dangerous Capabilitydist/sous.js
CriticalPrevious Version Dangerous Deltadist/sous.js
HighChild Processdist/sous.js
HighShell
HighEvaldist/sous.js
HighCredential Redirect Persistencedist/sous.js
HighTrigger Reachable Command Output Exfiltrationdist/sous.js
HighSemantic Analysis Limiteddist/sous.js
MediumDynamic Requiredist/sous.js
Medium
Affected versions and remediation
This report applies to @sous-io/sous@1.0.7.
See all versions of @sous-io/sous for other recorded verdicts.
- Review the evidence and your use of @sous-io/sous@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.