registry / @two-tech-dev/pxml-core / 0.9.1

@two-tech-dev/pxml-core@0.9.1

pxml core library — parser, codegen, runner, and all compilation logic

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Explicit code-generation and package-install operations can execute commands and clone repositories in the caller's project. No install-time or import-time attack behavior is established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Caller invokes code generation for a `setup-command` node, package installation, or parsing of a project import.

Impact

A malicious project specification, provider response, or package URL can cause arbitrary command execution in the caller's working directory.

Mechanism

User-configured AI command execution and project-configured git cloning.

Rationale

This is a real dangerous capability with unsanitized command execution, not a concrete malicious chain. The static malicious label is unsupported by the package lifecycle and entrypoint source.

Evidence

package.jsondist/index.jssrc/codegen/index.tssrc/install/index.tssrc/parser/index.tssrc/editor-schema/index.tspxml.jsonproject.xml.pxml/packagespackages.pxml-temp-init.vscode/settings.json

Network endpoints3

api.openai.com/v1localhost:11434github.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/codegen/index.ts` executes an AI-generated setup command with `execSync`.
`src/install/index.ts` shells out to `git clone` using URLs from `pxml.json`.
`src/parser/index.ts` clones `github:` imports into `.pxml/packages`.
`src/codegen/index.ts` sends configured prompts to AI provider endpoints.

Evidence against

`package.json` has no preinstall/install/postinstall/prepare hook or bin entry.
`dist/index.js` only exports APIs; importing it does not invoke commands or networking.
AI keys are supplied through configuration/CLI environment selection, not harvested.
No source evidence of credential theft, stealth persistence, destructive payload, or agent-control mutation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 42 file(s), 232 KB of source, external domains: api.openai.com, github.com, www.w3.org

Source & flagged code

3 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);

dist/codegen/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @two-tech-dev/pxml-core@0.9.0 matchedIdentity = npm:QHR3by10ZWNoLWRldi9weG1sLWNvcmU:0.9.0 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codegen/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/install/index.jsView file

2import * as path from 'path'; L3: import { execSync } from 'child_process'; L4: import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

dist/validator/index.jsView file

26const localTsc = path.join(cwd, 'node_modules', '.bin', 'tsc'); L27: const tscBin = fs.existsSync(localTsc) ? `"${localTsc}"` : 'npx tsc'; L28: cmd = `${tscBin} --noEmit`; ... L31: try { L32: execSync(cmd, { cwd, stdio: 'pipe' }); L33: return { ok: true, errors: '', raw: '' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/validator/index.jsView on unpkg · L26

dist/codegen/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codegen/index.jsView on unpkg

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/codegen/index.js

HighChild Processdist/install/index.js

HighShell

HighRuntime Package Installdist/validator/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);

dist/codegen/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codegen/index.jsView on unpkg