registry / Malware / @trypattern/sdk / 0.1.31

@trypattern/sdk@0.1.31

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The flagged download and install behavior is activated by an explicit pull command, but the resulting agent instruction directs an unapproved live publish. That concrete account change supports blocking the package.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs `app pull` for a starter project and a coding agent follows the CLI's generated next steps.

Impact

A live site may be changed without the owner's approval.

Mechanism

The CLI-generated instruction tells the agent to edit the project, run checks, and immediately run `app publish`, explicitly saying the first change goes live without asking.

Attack narrative

When a starter is pulled, the CLI generates next steps for the coding agent that direct it to change the project and publish immediately, saying that the change goes live without asking. The publish command uploads the project to onpattern.app. An agent following the generated instruction can therefore make a live site change without owner approval.

AI rationale

Evidence

package.jsondist/cli/app.jsdist/cli/publishing.js

Network endpoints1

onpattern.app

Decision evidence

public snapshot

AI called this Malicious at 89.0% confidence as Malware with low false-positive risk.

Evidence for block

The package exposes `app` as a CLI, and `app pull` downloads a site and installs it when the user invokes that command.
After pulling a starter, the CLI directs the coding agent to make a project change and run `app publish` immediately, stating that it goes live without asking.
The publish command uploads the project build and source to the service, so following that generated instruction makes a live account change.

Evidence against

The pull and publish flows require explicit CLI commands; the inspected package manifest exposes no install-time trigger for this chain.
The `.claude` references in the flagged locations concern formatting and ignoring a directory, not writing agent configuration. The concern is the generated instruction to publish without approval.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

8 flagged

dist/cli/publishing.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

3import { homedir } from 'node:os';

4import { basename, dirname, extname, join, matchesGlob, relative } from 'node:path';

5import { z } from 'zod';

6import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../publishWire.js";

7import { appInfo } from "../appTitle.js";

8import { SESSION_COOKIE } from "../auth/user.js";

9import { PROJECT_FILE, blueprintOf, readProjectFile, rememberVersion } from "../vite/projectFile.js";

10const CONFIG_DIR = join(homedir(), '.config', 'pattern');

11const CREDENTIALS_FILE = join(CONFIG_DIR, 'credentials.json');

12const PENDING_FILE = join(CONFIG_DIR, 'pending-login.json');

13const LOGIN_MINUTES = 10;

14const POLL_MS = 2000;

15const LOGIN_WAIT_MS = 100_000;

16const PUBLISH_WAIT_MS = 300_000;

17const LAUNCHER = 'app';

18const STARTER_WORKSPACE = 'pnpm-workspace.yaml';

19const STARTER_BUILD_SETTINGS = 'allowBuilds:\n esbuild: false\n workerd: false\n';

20const IGNORED_IN_EMPTY_FOLDER = new Set(['.DS_Store', '.claude']);

21const MIME_TYPES = {

dist/cli/starter.jsView file

Lines 59-99javascript

59 const parsed = table.fields.safeParse(fields);

60 if (!parsed.success) {

61 const issue = parsed.error.issues[0];

dist/cli/publishing.js#virtual:normalized:round1View file

1import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } f... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, blueprintOf, readProjectFile, rememberVersion } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: export function dashboard() { L52: return (process.env.PATTERN_DASHBOARD_URL ?? DASHBOARD_URL).replace(/\/$

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/publishing.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js L1: import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } f... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, blueprintOf, readProjectFile, rememberVersion } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: export function dashboar

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/app.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trypattern/sdk@0.1.22 matchedIdentity = npm:QHRyeXBhdHRlcm4vc2Rr:0.1.22 similarity = 0.808 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/app.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/cli/publishing.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

dist/cli/starter.jsView file

79return undefined; L80: const module = await import(__rewriteRelativeImportExtension(pathToFileURL(file).href)); L81: const starter = record(module)['starter'];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/starter.jsView on unpkg · L79

dist/cli/publishing.js#virtual:normalized:round1View file

Findings

3 Critical4 High4 Medium5 Low

CriticalDownload Executedist/cli/publishing.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/cli/publishing.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/cli/app.js

HighChild Processdist/cli/publishing.js

HighCommand Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/cli/publishing.js#virtual:normalized:round1

MediumDynamic Requiredist/cli/starter.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @trypattern/sdk@0.1.31.

See all versions of @trypattern/sdk for other recorded verdicts.

Avoid installing @trypattern/sdk@0.1.31. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-18 17:13:54.251Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages