registry / aiblueprint-cli / 1.4.106
aiblueprint-cli@1.4.106
⚠ Under reviewAIBlueprint CLI for setting up AI coding configurations
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
WildcardDependency
Source & flagged code
12 flaggeddist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = aiblueprint-cli@1.4.96
matchedIdentity = npm:YWlibHVlcHJpbnQtY2xp:1.4.96
similarity = 0.981
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg616var EventEmitter = __require("node:events").EventEmitter;
L617: var childProcess = __require("node:child_process");
L618: var path = __require("node:path");
High
1058}
L1059: const execArgv = process2.execArgv ?? [];
L1060: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical8 High6 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighSandbox Evasion Gated Capabilityagents-config/claude-config/scripts/statusline/src/lib/features/limits/index.ts
HighTrigger Reachable Persistencedist/cli.js
HighRuntime Package Installdist/cli.js
HighSemantic Analysis Limitedagents-config/skills/skill-manager/scripts/inspect-description.ts
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistence
Affected versions and remediation
This report applies to aiblueprint-cli@1.4.106.
See all versions of aiblueprint-cli for other recorded verdicts.
- Review the evidence and your use of aiblueprint-cli@1.4.106 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.