registry / AI-agent capability abuse / @trypattern/sdk / 0.1.16

@trypattern/sdk@0.1.16

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The package does not automatically publish during installation or pulling, but its first-pull instructions explicitly direct an agent to publish a change without owner approval. That conditional agent capability is a concrete residual risk, while the source does not establish an autonomous attack.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user or agent runs `app pull` for a starter or a site that has not previously been pulled.

Impact

If followed, the workflow can put an agent-made change live without asking the owner first.

Mechanism

The CLI prints a first-change workflow that directs the agent to edit the project and run `app publish`; that command submits a signed-in publish request to Pattern.

AI rationale

Evidence

dist/cli/app.jsdist/cli/publishing.jssrc/theme/theme.ts

Network endpoints1

onpattern.app

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json exposes `dist/cli/app.js` as a command and lists development scripts, with no install lifecycle hook shown.
The `.claude` references in `dist/cli/app.js` and `dist/cli/publishing.js` are formatter input and an empty-folder exclusion, not agent configuration writes.
After an explicit `app pull`, first-time or starter pulls return onboarding instructions through `firstChange`.
Those instructions direct Claude to change the site and publish the first change “without asking.”
Publishing sends a signed-in POST to the app’s publishes endpoint; the default dashboard is `https://onpattern.app`.
The CLI’s publish command is described as building and putting the app live.

Evidence against

The CLI does not invoke publishing as part of the pull flow; the publish instruction is printed as a next step and requires a separate command.
Pull and publish operate on the selected Pattern site, and publishing uses the Pattern dashboard.

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

9 flagged

dist/cli/publishing.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

3import { homedir } from 'node:os';

4import { basename, dirname, extname, join, matchesGlob, relative } from 'node:path';

5import { z } from 'zod';

6import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../publishWire.js";

7import { appInfo } from "../appTitle.js";

8import { SESSION_COOKIE } from "../auth/user.js";

9import { PROJECT_FILE, blueprintOf, readProjectFile } from "../vite/projectFile.js";

10const CONFIG_DIR = join(homedir(), '.config', 'pattern');

11const CREDENTIALS_FILE = join(CONFIG_DIR, 'credentials.json');

12const PENDING_FILE = join(CONFIG_DIR, 'pending-login.json');

13const LOGIN_MINUTES = 10;

14const POLL_MS = 2000;

15const LOGIN_WAIT_MS = 100_000;

16const PUBLISH_WAIT_MS = 300_000;

17const LAUNCHER = 'app';

18const STARTER_WORKSPACE = 'pnpm-workspace.yaml';

19const STARTER_BUILD_SETTINGS = 'allowBuilds:\n esbuild: false\n workerd: false\n';

20const IGNORED_IN_EMPTY_FOLDER = new Set(['.DS_Store', '.claude']);

21const MIME_TYPES = {

•matchType = previous_version_dangerous_delta matchedPackage = @trypattern/sdk@0.1.15 matchedIdentity = npm:QHRyeXBhdHRlcm4vc2Rr:0.1.15 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/publishing.jsView on unpkg

dist/cli/starter.jsView file

Lines 59-99javascript

59 const parsed = table.fields.safeParse(fields);

60 if (!parsed.success) {

61 const issue = parsed.error.issues[0];

dist/cli/app.js#virtual:normalized:round1View file

264current directory to the nearest project launcher (an executable ./app containing the line L265: ${LAUNCHER_MARKER_LINE}) and runs it, so each project"s CLI lives in its repo and the shim\nnever needs updating. Replaces older Jig or starter-kit shims; refuses to overwrite an\n... L266: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/app.js#virtual:normalized:round1View on unpkg · L264

264Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli/app.js L264: current directory to the nearest project launcher (an executable ./app containing the line L265: ${LAUNCHER_MARKER_LINE}) and runs it, so each project"s CLI lives in its repo and the shim\nnever needs updating. Replaces older Jig or starter-kit shims; refuses to overwrite an\n... L266: };

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/app.js#virtual:normalized:round1View on unpkg · L264

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/publishing.js#virtual:normalized:round1View file

1import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } f... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, blueprintOf, readProjectFile } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: function dashboard() { L52: return (process.env.PATTERN_DASHBOARD_URL ?? DASHBOARD_URL).replace(/\/$/, ""); L53: } ... L66:

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/publishing.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js L1: import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } f... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, blueprintOf, readProjectFile } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: function dashboard() { L52: return (proce

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Source & flagged code

9 flagged · loading source

dist/cli/publishing.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/publishing.jsView on unpkg

1import { spawnSync } from 'node:child_process'; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

dist/cli/starter.jsView file

79return undefined; L80: const module = await import(__rewriteRelativeImportExtension(pathToFileURL(file).href)); L81: const starter = record(module)['starter'];

Findings

3 Critical5 High4 Medium5 Low

CriticalDownload Executedist/cli/publishing.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/cli/publishing.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/cli/publishing.js

HighChild Processdist/cli/publishing.js

HighSame File Env Network Executiondist/cli/app.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/cli/app.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/cli/app.js#virtual:normalized:round1

MediumDynamic Requiredist/cli/starter.js

MediumNetwork

Affected versions and remediation

This report applies to @trypattern/sdk@0.1.16.

See all versions of @trypattern/sdk for other recorded verdicts.

Review the evidence and your use of @trypattern/sdk@0.1.16 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 13:44:48.393Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.