@trypattern/sdk@0.1.7

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the flagged download and process behavior is part of an explicit project pull command. Inspected agent-related locations do not mutate agent configuration, and authentication uses the package’s fixed service endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes a CLI command such as `app pull`, `app publish`, or `app login`.

Impact

No package-controlled attack impact is established; the observed actions follow explicit CLI commands and use Pattern service endpoints.

Mechanism

The pull command downloads site source into its target and runs that project’s dependency installation and setup; publishing uploads project files to the Pattern dashboard.

AI rationale

Network endpoints2

onpattern.appauth.trypattern.ai

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes a CLI and lists development scripts, with no install lifecycle hook.
The download behavior belongs to the named `app pull` command; it writes fetched site files into the target, then runs `pnpm install` and setup.
The `.claude` references are a formatting glob and an entry ignored when checking whether a pull target is empty; no agent configuration is changed there.
The CLI stores cookies under the selected dashboard and sends them to that same dashboard.
The shortcut hook calls a supplied handler for eligible key presses.
Server authentication sends its secret to the fixed `auth.trypattern.ai` service.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

8 flagged

dist/cli/publishing.jsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

3import { homedir } from 'node:os';

4import { basename, dirname, extname, join, matchesGlob, relative } from 'node:path';

5import { z } from 'zod';

6import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../publishWire.js";

7import { appInfo } from "../appTitle.js";

8import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js";

9const CONFIG_DIR = join(homedir(), '.config', 'pattern');

10const CREDENTIALS_FILE = join(CONFIG_DIR, 'credentials.json');

11const PENDING_FILE = join(CONFIG_DIR, 'pending-login.json');

12const LOGIN_MINUTES = 10;

13const POLL_MS = 2000;

14const LOGIN_WAIT_MS = 100_000;

15const PUBLISH_WAIT_MS = 300_000;

16const SESSION_COOKIE = 'pattern_session';

17const LAUNCHER = 'app';

18const STARTER_WORKSPACE = 'pnpm-workspace.yaml';

19const STARTER_BUILD_SETTINGS = 'allowBuilds:\n esbuild: false\n workerd: false\n';

20const IGNORED_IN_EMPTY_FOLDER = new Set(['.DS_Store', '.claude']);

21const MIME_TYPES = {

presets/lintPlugin.jsView file

Lines 1-8javascript

1import { existsSync } from 'node:fs'

3const source = new URL('../src/rules/lintPlugin.ts', import.meta.url)

4const built

dist/cli/app.js#virtual:normalized:round1View file

235current directory to the nearest project launcher (an executable ./app containing the line L236: ${LAUNCHER_MARKER_LINE}) and runs it, so each project"s CLI lives in its repo and the shim\nnever needs updating. Replaces older Jig or starter-kit shims; refuses to overwrite an\n... L237: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/app.js#virtual:normalized:round1View on unpkg · L235

235Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/cli/app.js L235: current directory to the nearest project launcher (an executable ./app containing the line L236: ${LAUNCHER_MARKER_LINE}) and runs it, so each project"s CLI lives in its repo and the shim\nnever needs updating. Replaces older Jig or starter-kit shims; refuses to overwrite an\n... L237: };

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/app.js#virtual:normalized:round1View on unpkg · L235

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/publishing.js#virtual:normalized:round1View file

1import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../pu... L7: import { appInfo } from "../appTitle.js"; L8: import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js"; L9: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L10: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: function dashboard() { L52: return (process.env.PATTERN_DASHBOARD_URL ?? DASHBOARD_URL).replace(/\/$/, ""); L53: } ... L63: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/publishing.js#virtual:normalized:round1View on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/cli/app.js -> dist/cli/publishing.js L1: import { spawnSync } from "node:child_process"; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L5: import { z } from "zod"; L6: import { DASHBOARD_URL, UPLOAD, appSummary, isPrivatePath, loginPoll, loginStarted, nameProblem, publishMessage, publishSummary, setupCodeExchanged, sourcePathProblem } from "../pu... L7: import { appInfo } from "../appTitle.js"; L8: import { PROJECT_FILE, readProjectFile } from "../vite/projectFile.js"; L9: const CONFIG_DIR = join(homedir(), ".config", "pattern"); L10: const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json"); ... L51: function dashboard() { L52: return (process.env.PATTERN_DAS

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Source & flagged code

8 flagged · loading source

dist/cli/publishing.jsView file

1import { spawnSync } from 'node:child_process'; L2: import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/cli/publishing.jsView on unpkg · L1

presets/lintPlugin.jsView file

4const built = new URL('../dist/rules/lintPlugin.js', import.meta.url) L5: const plugin = await import(existsSync(source) ? source.href : built.href) L6:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

presets/lintPlugin.jsView on unpkg · L4

dist/cli/app.js#virtual:normalized:round1View file

Findings

2 Critical5 High4 Medium5 Low

CriticalDownload Executedist/cli/publishing.js#virtual:normalized:round1

CriticalTrigger Reachable Dangerous Capabilitydist/cli/publishing.js#virtual:normalized:round1

HighChild Processdist/cli/publishing.js

HighSame File Env Network Executiondist/cli/app.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/cli/publishing.js#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationdist/cli/app.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/cli/app.js#virtual:normalized:round1

MediumDynamic Requirepresets/lintPlugin.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @trypattern/sdk@0.1.7.

See all versions of @trypattern/sdk for other recorded verdicts.

Review the evidence and your use of @trypattern/sdk@0.1.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 08:13:42.818Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.