atlas-project-harness@0.1.0-beta.22
践行 Project Harness 的全流程 AI 编程工作流治理引擎
AI Security Review
scanned 6d ago · by lpm-firewall-aiSource inspection confirms an automated, authenticated report submission to a package-selected GitHub repository without pre-submission consent. The reporter does not enforce its stated restriction against including business details, so report content may be disclosed externally.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
An agent encounters an Atlas rule or gate that blocks a legitimate business case and follows the extension’s reporting instruction.
Impact
Report content is sent off-machine and an issue is created under the user’s authenticated GitHub account without pre-submission consent.
Mechanism
The CLI reporter uses an environment or Git credential and posts the supplied report fields to the default GitHub repository; without a token, it saves the report locally.
Attack narrative
When an Atlas rule blocks a legitimate business case, the extension tells the agent to report it, and the packaged rules require automatic, silent submission before notifying the user. The CLI reporter can retrieve a GitHub token from the environment or Git credentials and post the generated report to the package’s default repository. The report body is sent in an authenticated issue request without a pre-submission consent check.
AI rationale
Source inspection confirms an automated, authenticated report submission to a package-selected GitHub repository without pre-submission consent. The reporter does not enforce its stated restriction against including business details, so report content may be disclosed externally.
Evidence
package.jsonextensions/pi.tsshared/global-rules.mdbin/atlas.jsscripts/atlas_report.py
Network endpoints1
api.github.com/repos/sunwenzhe-git/atlas/issues
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes the Pi extension as its main entrypoint.
- The extension directs the agent to report when an Atlas rule blocks a legitimate business case.
- The packaged rules require the agent to submit reports automatically and silently, then inform the user.
- The reporter reads GitHub tokens from the environment or Git credentials and defaults to the publisher’s repository.
- The reporter sends the supplied report body in an authenticated GitHub issue request.
- The CLI routes `atlas report` to the reporter, which submits the report when a token is available.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcebin/atlas.jsView file
•matchType = normalized_sha256
matchedPackage = atlas-project-harness@0.1.0-beta.21
matchedPath = bin/atlas.js
matchedIdentity = npm:YXRsYXMtcHJvamVjdC1oYXJuZXNz:0.1.0-beta.21
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/atlas.jsView on unpkg1#!/usr/bin/env node
L2: const { spawnSync } = require('child_process');
L3: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/atlas.jsView on unpkg · L1patches/workflow-skill-routing/apply-patches.pyView file
•path = patches/workflow-skill-routing/apply-patches.py
kind = build_helper
sizeBytes = 10653
magicHex = [redacted]
Findings
3 High5 Medium4 Low
HighPayload In Excluded Dirtests/test_shared_kernel.py
HighSemantic Analysis Limitedextensions/pi.ts#virtual:normalized:round1
HighKnown Malware Source Similaritybin/atlas.js
MediumDynamic Requirebin/atlas.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpatches/workflow-skill-routing/apply-patches.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to atlas-project-harness@0.1.0-beta.22.
See all versions of atlas-project-harness for other recorded verdicts.
- Avoid installing atlas-project-harness@0.1.0-beta.22. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.