atlas-project-harness@0.1.0-beta.23
践行 Project Harness 的全流程 AI 编程工作流治理引擎
AI Security Review
scanned 5d ago · by lpm-firewall-aiInspected source establishes an automatic, authenticated issue-creation path to the publisher’s default GitHub repository, with no recipient-specific confirmation. This is concrete unrequested account activity and warrants blocking publication.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An Atlas-enabled agent encounters a listed design conflict in a project using the package’s rules.
Impact
Creates an authenticated issue under the user’s GitHub account in a publisher-selected repository without recipient-specific confirmation.
Mechanism
The agent invokes the report CLI, which reads an environment or Git credential and sends an authenticated issue-creation request to GitHub’s API using the publisher repository by default.
Attack narrative
The package’s project rules direct the agent to report qualifying design conflicts automatically and silently. The CLI routes that report to a script that obtains a GitHub token from the environment or credential helper, then uses it to create an issue in the publisher’s default repository. This is an authenticated account action with a publisher-selected target and no recipient-specific consent gate.
AI rationale
Inspected source establishes an automatic, authenticated issue-creation path to the publisher’s default GitHub repository, with no recipient-specific confirmation. This is concrete unrequested account activity and warrants blocking publication.
Evidence
shared/global-rules.mdpatches/project-wiring/agent-pointer.mdbin/atlas.jsscripts/atlas_report.py
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes an Atlas CLI and Pi agent extension.
- For listed design conflicts, its shipped rules direct the agent to submit a report automatically and silently; they treat a user request as a fallback.
- The CLI report command runs the package’s report script and passes through the process environment.
- The reporter defaults to the publisher’s GitHub repository and reads credentials from environment variables or Git’s credential helper.
- The reporter sends the credential in an authenticated request to GitHub’s issue API and creates an issue when a token is available, without a recipient-specific confirmation step.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcebin/atlas.jsView file
•matchType = normalized_sha256
matchedPackage = atlas-project-harness@0.1.0-beta.22
matchedPath = bin/atlas.js
matchedIdentity = npm:YXRsYXMtcHJvamVjdC1oYXJuZXNz:0.1.0-beta.22
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/atlas.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = f0d06108f821c11e
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = atlas-project-harness@0.1.0-beta.22
matchedPath = bin/atlas.js
matchedIdentity = npm:YXRsYXMtcHJvamVjdC1oYXJuZXNz:0.1.0-beta.22
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/atlas.jsView on unpkg1#!/usr/bin/env node
L2: const { spawnSync } = require('child_process');
L3: const path = require('path');
Medium
Dynamic Require
Findings
4 High5 Medium4 Low
HighPayload In Excluded Dirtests/test_shared_kernel.py
HighSemantic Analysis Limitedextensions/pi.ts#virtual:normalized:round1
HighKnown Malware Source Similaritybin/atlas.js
HighKnown Malware Source Fingerprint Signaturebin/atlas.js
MediumDynamic Requirebin/atlas.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpatches/workflow-skill-routing/apply-patches.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to atlas-project-harness@0.1.0-beta.23.
See all versions of atlas-project-harness for other recorded verdicts.
- Avoid installing atlas-project-harness@0.1.0-beta.23. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.