aislop@0.16.1
Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#,
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and agent configuration changes are performed through the explicit hook setup command. The scanner’s credential redirect claim is unsupported by inspected source; the observed network request is package telemetry with disable controls.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was found; agent hooks require a CLI setup command, and telemetry runs during package use subject to its configuration gates.
Impact
No confirmed attack impact was established.
Mechanism
The source registers package hooks in agent configuration and sends allowlisted runtime metadata to the package telemetry endpoint. It does not establish credential forwarding or remote command execution.
AI rationale
The manifest has no install lifecycle hook, and agent configuration changes are performed through the explicit hook setup command. The scanner’s credential redirect claim is unsupported by inspected source; the observed network request is package telemetry with disable controls.
Network endpoints1
eu.i.posthog.com
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json lists development and build scripts, with no preinstall, install, or postinstall hook.
- Agent hook setup is exposed as a CLI command; it prompts for agent selection, and the Claude configuration paths are scoped to the project or user configuration.
- Telemetry sends an anonymous install identifier and runtime metadata to the package’s PostHog endpoint; configuration, environment flags, and CI can disable it.
- The MCP entrypoint registers local scan and fix tools, and the framework adapter runs its helper only when explicitly enabled.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/core-D4295PVP.jsView file
1import { spawn } from "node:child_process";
L2: import process from "node:process";
High
Child Process
Package source references child process execution.
dist/core-D4295PVP.jsView on unpkg · L1dist/index.jsView file
13753};
L13754: const isSafeShellSpawnArray = (content, matchIndex) => /^spawn\s*\(\s*\[/.test(content.slice(matchIndex)) && !/^\s*spawn\s*\(\s*\[\s*["'](?:sh|bash|zsh|cmd|cmd\.exe|powershell|pwsh...
L13755: const PLACEHOLDER_EXPR_RE = /^(?:placeholders?|placeholderList|bindMarkers?|bindingMarkers?|bindPlaceholders?|bindingPlaceholders?|parameterPlaceholders?|sqlPlaceholders?)(?:\.\w+\...
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
import * as readline from "node:readline";
let baseUrlOption;
if (Object.hasOwn(compilerOptions, "baseUrl")) baseUrlOption = {
value: compilerOptions.baseUrl
const baseDir = baseUrlOption && typeof baseUrlOption.value === "string" ? safeProjectDirectoryPath(path.resolve(path.dirname(baseUrlOption.configPath), baseUrlOption.value), rootD...
"readline",
const URL_CONFIG_CONTEXT_RE = /\b(?:api|base[_-]?url|baseUrl|endpoint|host|origin|webhook|callback|redirect|server|service|domain|url)\b/i;
if (changed) fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, " ")}\n`);
Findings
1 Critical5 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/mcp.js
HighChild Processdist/core-D4295PVP.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighRemote Agent Bridgedist/cli.js
HighCross File Remote Execution Contextdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to aislop@0.16.1.
See all versions of aislop for other recorded verdicts.
- Review the evidence and your use of aislop@0.16.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.