@withfudge/design@0.10.1
Local Fudge design CLI and MCP server for querying saved pins with Prolog.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms an explicit-user-command AI-agent configuration capability, not concrete malicious behavior. Per policy, this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs fudge install or fudge setup; configured client starts its Fudge MCP server.
Impact
Adds a Fudge MCP launcher and skills; future npx latest resolution can change the executed package version.
Mechanism
Explicit MCP/skill installation plus release-data retrieval
AI rationale
Source inspection confirms an explicit-user-command AI-agent configuration capability, not concrete malicious behavior. Per policy, this warrants a warning rather than a block.
Evidence
package.jsondist/cli.jsdist/ops/install.jsdist/ops/setup.jsdist/ops/login.jsdist/ops/release-session.jsdist/ops/telemetry.js~/.agents/skillsagent client config paths
Network endpoints3
api.withfudge.comapi.fontofweb.compub-3a14aed695744ee3ae7b28553e18cf81.r2.dev
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/ops/install.js: explicit install writes Fudge MCP entries to supported agent configs and copies skills to ~/.agents/skills.
- Installed MCP command uses npx with @withfudge/design@latest, allowing future package updates when the client starts.
- dist/ops/release-session.js fetches release-managed Prolog resources and loads them into its WASM runtime.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- dist/cli.js activates setup/install only for explicit fudge commands.
- dist/ops/login.js uses loopback OAuth PKCE and writes the resulting session locally.
- dist/ops/telemetry.js sends coarse authenticated product events and offers opt-out; no query/source content is sent.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinified
Source & flagged code
4 flaggeddist/ops/package-info.jsView file
1import { createRequire } from "node:module";
L2: const require = createRequire(import.meta.url);
L3: const manifest = require("../../package.json");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/ops/package-info.jsView on unpkg · L1dist/ops/login.jsView file
1import { createHash, randomBytes } from "node:crypto";
L2: import { spawn } from "node:child_process";
L3: import { createServer } from "node:http";
L4: import { writeSession } from "./auth.js";
...
L7: export async function browserLoopbackLogin(options = {}) {
L8: const state = randomBase64url(24);
L9: const codeVerifier = randomBase64url(48);
...
L45: headers: { "content-type": "application/json" },
L46: body: JSON.stringify({ code, code_verifier: codeVerifier }),
L47: });
...
L112: }
L113: export function browserOpenCommand(url, targetPlatform = process.platform) {
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/ops/login.jsView on unpkg · L1Findings
2 High5 Medium6 Low
HighSandbox Evasion Gated Capabilitydist/ops/login.js
HighPrevious Version Dangerous Deltadist/ops/login.js
MediumDynamic Requiredist/ops/package-info.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperrecipes/contrast-ratio.pl
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @withfudge/design@0.10.1.
See all versions of @withfudge/design for other recorded verdicts.
- Review the evidence and your use of @withfudge/design@0.10.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.