registry / AI-agent capability abuse / @trypattern/sdk / 0.1.32

@trypattern/sdk@0.1.32

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The install and runtime download-execute hints do not establish an attack: source download, dependency installation, and setup occur through an explicit pull command. The generated instruction to publish without asking creates a residual agent capability risk, so warn rather than block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user runs the CLI pull command for a starter app.

Impact

An agent following the printed instructions could publish a site change without obtaining separate approval.

Mechanism

The CLI downloads the selected app, installs its dependencies, runs setup, and returns follow-up instructions that direct an agent to publish the first change without asking.

AI rationale

Evidence

dist/cli/publishing.jsdist/cli/app.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes a CLI and lists development scripts; no install lifecycle hook is present.
The CLI describes its global launcher shim, and its implementation refuses to overwrite an unrecognized existing shim.
Pull downloads a named app’s source and runs dependency installation and setup as part of that command.
For a newly pulled starter, the CLI prints instructions telling an agent to publish its first change without asking.

Evidence against

The publish instruction is emitted after the explicit pull command; inspected code does not publish automatically at install or import time.
The shim setup is described as an explicit setup command and checks for an existing unrecognized file before writing.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Source & flagged code

10 flagged

dist/cli/publishing.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

3import { homedir } from 'node:os';

4import { basename, dirname, extname, join, matchesGlob, relative } from 'node:path';

5import { z } from 'zod';

6import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../publishWire.js";

7import { appInfo } from "../appTitle.js";

8import { SESSION_COOKIE } from "../auth/user.js";

9import { PROJECT_FILE, blueprintOf, readProjectFile, rememberVersion } from "../vite/projectFile.js";

10const CONFIG_DIR = join(homedir(), '.config', 'pattern');

11const CREDENTIALS_FILE = join(CONFIG_DIR, 'credentials.json');

12const PENDING_FILE = join(CONFIG_DIR, 'pending-login.json');

13const LOGIN_MINUTES = 10;

14const POLL_MS = 2000;

15const LOGIN_WAIT_MS = 100_000;

16const PUBLISH_WAIT_MS = 300_000;

17const LAUNCHER = 'app';

18const STARTER_WORKSPACE = 'pnpm-workspace.yaml';

19const STARTER_BUILD_SETTINGS = 'allowBuilds:\n esbuild: false\n workerd: false\n';

20const IGNORED_IN_EMPTY_FOLDER = new Set(['.DS_Store', '.claude']);

21const MIME_TYPES = {

•matchType = normalized_sha256 matchedPackage = @trypattern/sdk@0.1.31 matchedPath = dist/cli/publishing.js matchedIdentity = npm:QHRyeXBhdHRlcm4vc2Rr:0.1.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/publishing.jsView on unpkg

dist/cli/starter.jsView file

Lines 59-99javascript

59 const parsed = table.fields.safeParse(fields);

60 if (!parsed.success) {

61 const issue = parsed.error.issues[0];

dist/cli/publishing.js#virtual:normalized:round1View file

1import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } f... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, blueprintOf, readProjectFile, rememberVersion } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: export function dashboard() { L52: return (process.env.PATTERN_DASHBOARD_URL ?? DASHBOARD_URL).replace(/\/$

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/publishing.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js L1: import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, mediaRow, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } f... L7: import { appInfo } from "../appTitle.js"; ... L9: import { PROJECT_FILE, blueprintOf, readProjectFile, rememberVersion } from "../vite/projectFile.js"; L10: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L11: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: export function dashboar

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/app.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trypattern/sdk@0.1.22 matchedIdentity = npm:QHRyeXBhdHRlcm4vc2Rr:0.1.22 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/app.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @trypattern/sdk@0.1.31 matchedPath = dist/cli/app.js matchedIdentity = npm:QHRyeXBhdHRlcm4vc2Rr:0.1.31 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/app.jsView on unpkg

Source & flagged code

10 flagged · loading source

dist/cli/publishing.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/publishing.jsView on unpkg

dist/cli/starter.jsView file

79return undefined; L80: const module = await import(__rewriteRelativeImportExtension(pathToFileURL(file).href)); L81: const starter = record(module)['starter'];

Findings

3 Critical6 High4 Medium5 Low

CriticalDownload Executedist/cli/publishing.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/cli/publishing.js#virtual:normalized:round1

CriticalPrevious Version Dangerous Deltadist/cli/app.js

HighChild Processdist/cli/publishing.js

HighCommand Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/cli/publishing.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/cli/app.js

HighKnown Malware Source Similaritydist/cli/publishing.js

MediumDynamic Requiredist/cli/starter.js

Affected versions and remediation

This report applies to @trypattern/sdk@0.1.32.

See all versions of @trypattern/sdk for other recorded verdicts.

Review the evidence and your use of @trypattern/sdk@0.1.32 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 17:25:40.621Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.