registry / @two-tech-dev/pxml-core / 0.9.2

@two-tech-dev/pxml-core@0.9.2

pxml core library — parser, codegen, runner, and all compilation logic

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Explicit code-generation workflows can execute arbitrary shell text returned by a configured AI provider. Explicit package-install/import workflows clone caller-configured Git repositories and may update VS Code XML catalog settings.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes PXML code generation with a `setup-command`, or invokes package installation/import parsing.

Impact

A compromised or prompt-influenced model response, or untrusted project manifest, can execute commands and modify the active project.

Mechanism

Model-output shell execution and manifest-driven Git cloning.

Rationale

The package is not malicious by source intent or installation behavior, but it exposes high-risk remote/model-influenced command execution in user-invoked workflows. Flag as warn for dangerous capability rather than block.

Evidence

package.jsondist/index.jssrc/codegen/index.tssrc/install/index.tssrc/parser/index.tssrc/editor-schema/index.tsproject working directorypxml.jsonpackages/<name>.pxml/packages/github/<owner>/<repo>.vscode/settings.json.pxml/logs/<node>.log

Network endpoints2

api.openai.com/v1localhost:11434

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/codegen/index.ts` executes AI-generated `setup-command` text with `execSync`.
Setup commands run in the current working directory after model output, without an allowlist or confirmation.
`src/install/index.ts` clones manifest-supplied Git URLs through shell interpolation.
`src/parser/index.ts` clones GitHub package imports during parse when absent locally.
`src/editor-schema/index.ts` modifies the invoking project's `.vscode/settings.json`.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
Entrypoint `dist/index.js` only exports APIs; it performs no import-time execution.
Network calls are explicit AI-provider requests using supplied API credentials.
Observed project writes occur in explicit CLI/library workflows, not package installation.
No credential harvesting, covert exfiltration, persistence, or destructive payload was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 42 file(s), 233 KB of source, external domains: api.openai.com, github.com, www.w3.org

Source & flagged code

3 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);

dist/codegen/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @two-tech-dev/pxml-core@0.9.1 matchedIdentity = npm:QHR3by10ZWNoLWRldi9weG1sLWNvcmU:0.9.1 similarity = 0.952 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codegen/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/install/index.jsView file

2import * as path from 'path'; L3: import { execSync } from 'child_process'; L4: import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

dist/validator/index.jsView file

26const localTsc = path.join(cwd, 'node_modules', '.bin', 'tsc'); L27: const tscBin = fs.existsSync(localTsc) ? `"${localTsc}"` : 'npx tsc'; L28: cmd = `${tscBin} --noEmit`; ... L31: try { L32: execSync(cmd, { cwd, stdio: 'pipe' }); L33: return { ok: true, errors: '', raw: '' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/validator/index.jsView on unpkg · L26

dist/codegen/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codegen/index.jsView on unpkg

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/codegen/index.js

HighChild Processdist/install/index.js

HighShell

HighRuntime Package Installdist/validator/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/install/index.jsView file

Lines 1-22javascript

1import * as fs from 'fs';

2import * as path from 'path';

3import { execSync } from 'child_process';

4import { addCatalogToVscodeSettings, syncEditorSchema } from '../editor-schema/index.js';

High

Child Process

Package source references child process execution.

dist/install/index.jsView on unpkg · L2

5import { PxmlParser } from '../parser/index.js';

6const MANIFEST = 'pxml.json';

7export function readPxmlManifest(cwd) {

8 const fp = path.join(cwd, MANIFEST);

9 if (!fs.existsSync(fp))

10 return null;

11 try {

12 return JSON.parse(fs.readFileSync(fp, 'utf-8'));

13 }

14 catch {

15 return null;

16 }

17}

18export function writePxmlManifest(cwd, m) {

19 fs.writeFileSync(path.join(cwd, MANIFEST), JSON.stringify(m, null, 2) + '\n');

20}

21export function addPackageToManifest(cwd, name, url) {

22 const m = readPxmlManifest(cwd) ?? { pxml: '', packages: {} };

dist/validator/index.jsView file

Lines 6-46javascript

6// (deterministic), so this works regardless of model quality.

7export function validateNode(node, cwd, stack = 'nextjs') {

8 const file = node.meta.path;

9 const abs = path.resolve(cwd, file);

dist/codegen/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/codegen/index.jsView on unpkg