registry / AI-agent capability abuse / @trypattern/sdk / 0.1.12

@trypattern/sdk@0.1.12

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The scanner's download and network signals map to explicit CLI project-pull and publishing flows. The starter-specific instruction to publish without separately asking creates a conditional AI-agent capability risk, so warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the CLI pull command for a starter site and an assistant follows the returned onboarding instructions.

Impact

A site could be changed and deployed without a distinct user confirmation of that publication.

Mechanism

The CLI emits instructions to make a site change and publish it; the publish command uploads project files to the Pattern service using the saved session.

AI rationale

Evidence

dist/cli/app.jsdist/cli/publishing.jsdist/publishWire.js

Network endpoints1

onpattern.app

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes a CLI and lists ordinary development scripts; no install lifecycle hook is present.
The indicated agent-related locations concern formatting `.claude` files and ignoring that folder in an empty-folder check; they do not mutate agent settings.
The explicit pull command downloads a selected site's source, and starter downloads receive a separate onboarding response.
That starter onboarding response directs an assistant to publish its first change without separately asking the user.
Publishing builds the project and posts its selected build and source files through the saved Pattern session.
The default publishing service is onpattern.app, the package's stated service destination.

Evidence against

The package manifest has no install hook, so this behavior does not run automatically during npm installation.
The publish action is an explicit CLI command, and the CLI describes the files sent and the destination.
The remote instruction is emitted only for a starter download; ordinary pulls instead direct the user to start the project.

Behavioral surface

Source & flagged code

7 flagged

dist/cli/publishing.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

3import { homedir } from 'node:os';

4import { basename, dirname, extname, join, matchesGlob, relative } from 'node:path';

5import { z } from 'zod';

6import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../publishWire.js";

7import { appInfo } from "../appTitle.js";

8import { SESSION_COOKIE } from "../auth/user.js";

9import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js";

10const CONFIG_DIR = join(homedir(), '.config', 'pattern');

11const CREDENTIALS_FILE = join(CONFIG_DIR, 'credentials.json');

12const PENDING_FILE = join(CONFIG_DIR, 'pending-login.json');

13const LOGIN_MINUTES = 10;

14const POLL_MS = 2000;

15const LOGIN_WAIT_MS = 100_000;

16const PUBLISH_WAIT_MS = 300_000;

17const LAUNCHER = 'app';

18const STARTER_WORKSPACE = 'pnpm-workspace.yaml';

19const STARTER_BUILD_SETTINGS = 'allowBuilds:\n esbuild: false\n workerd: false\n';

20const IGNORED_IN_EMPTY_FOLDER = new Set(['.DS_Store', '.claude']);

21const MIME_TYPES = {

presets/lintPlugin.jsView file

Lines 1-8javascript

1import { existsSync } from 'node:fs'

3const source = new URL('../src/rules/lintPlugin.ts', import.meta.url)

4const built

dist/cli/publishing.js#virtual:normalized:round1View file

1import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../pu... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: function dashboard() { L52: return (process.env.PATTERN_DASHBOARD_URL ?? DASHBOARD_URL).replace(/\/$/, ""); L53: } ... L63: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/publishing.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js L1: import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../pu... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: function dashboard() { L52: return (process.env.PATTER

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/app.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/app.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged · loading source

dist/cli/publishing.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

presets/lintPlugin.jsView file

4const built = new URL('../dist/rules/lintPlugin.js', import.meta.url) L5: const plugin = await import(existsSync(source) ? source.href : built.href) L6:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

presets/lintPlugin.jsView on unpkg · L4

dist/cli/publishing.js#virtual:normalized:round1View file

Findings

2 Critical4 High4 Medium5 Low

CriticalDownload Executedist/cli/publishing.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/cli/publishing.js#virtual:normalized:round1

HighChild Processdist/cli/publishing.js

HighCommand Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/cli/app.js#virtual:normalized:round1

MediumDynamic Requirepresets/lintPlugin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to @trypattern/sdk@0.1.12.

See all versions of @trypattern/sdk for other recorded verdicts.

Review the evidence and your use of @trypattern/sdk@0.1.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 11:34:40.730Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.