@trypattern/sdk
This report shows the evidence for @trypattern/sdk@0.1.31. 1 of 27 known versions is blocked or flagged. The newest version, 0.1.39, is allowed. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged download and install behavior is activated by an explicit pull command, but the resulting agent instruction directs an unapproved live publish. That concrete account change supports blocking the package.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs `app pull` for a starter project and a coding agent follows the CLI's generated next steps.
Impact
A live site may be changed without the owner's approval.
Mechanism
The CLI-generated instruction tells the agent to edit the project, run checks, and immediately run `app publish`, explicitly saying the first change goes live without asking.
Attack narrative
When a starter is pulled, the CLI generates next steps for the coding agent that direct it to change the project and publish immediately, saying that the change goes live without asking. The publish command uploads the project to onpattern.app. An agent following the generated instruction can therefore make a live site change without owner approval.
AI rationale
The flagged download and install behavior is activated by an explicit pull command, but the resulting agent instruction directs an unapproved live publish. That concrete account change supports blocking the package.
Evidence
package.jsondist/cli/app.jsdist/cli/publishing.js
Network endpoints1
onpattern.app
Decision evidence
public snapshotAI called this Malicious at 89.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes `app` as a CLI, and `app pull` downloads a site and installs it when the user invokes that command.
- After pulling a starter, the CLI directs the coding agent to make a project change and run `app publish` immediately, stating that it goes live without asking.
- The publish command uploads the project build and source to the service, so following that generated instruction makes a live account change.
Evidence against
- The pull and publish flows require explicit CLI commands; the inspected package manifest exposes no install-time trigger for this chain.
- The `.claude` references in the flagged locations concern formatting and ignoring a directory, not writing agent configuration. The concern is the generated instruction to publish without approval.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
8 flagged · loading sourcedist/cli/publishing.jsView file
1import { spawnSync } from 'node:child_process';
L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/cli/publishing.jsView on unpkg · L1dist/cli/starter.jsView file
79return undefined;
L80: const module = await import(__rewriteRelativeImportExtension(pathToFileURL(file).href));
L81: const starter = record(module)['starter'];
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli/starter.jsView on unpkg · L79dist/cli/publishing.js#virtual:normalized:round1View file
Findings
3 Critical4 High4 Medium5 Low
CriticalDownload Executedist/cli/publishing.js#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilitydist/cli/publishing.js#virtual:normalized:round1
CriticalPrevious Version Dangerous Deltadist/cli/app.js
HighChild Processdist/cli/publishing.js
HighCommand Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1
HighTrigger Reachable Command Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/cli/publishing.js#virtual:normalized:round1
MediumDynamic Requiredist/cli/starter.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @trypattern/sdk@0.1.31.
The versions list below shows the verdict for each recorded version.
- Avoid installing @trypattern/sdk@0.1.31. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.