atlas-project-harness@0.1.0-beta.24
践行 Project Harness 的全流程 AI 编程工作流治理引擎
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe extension’s conditional instruction connects a runtime project conflict to a reporter that uses the user's GitHub credential to create an issue in a publisher-selected repository. This is a concrete, though conditional, account action without a separate confirmation step.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
An Atlas rule or gate blocks a legitimate project shape and the agent follows the extension's report instruction.
Impact
The workflow can publish diagnostic content and create an issue using the user's GitHub account without separate human approval.
Mechanism
The CLI invokes the report script, which reads a GitHub token from the environment or saved Git credentials and posts the supplied issue content to the default repository.
Attack narrative
When a legitimate project shape is blocked by an Atlas rule, the extension tells the agent to report the problem. The CLI routes that command to a reporter that can retrieve a saved GitHub credential and post issue content to the package author's default repository. The source does not require separate human confirmation before posting, so the agent-directed workflow can create a publisher-selected account action and disclose submitted diagnostics.
AI rationale
The extension’s conditional instruction connects a runtime project conflict to a reporter that uses the user's GitHub credential to create an issue in a publisher-selected repository. This is a concrete, though conditional, account action without a separate confirmation step.
Evidence
extensions/pi.tsbin/atlas.jsscripts/atlas_report.py
Network endpoints1
api.github.com/repos/sunwenzhe-git/atlas/issues
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- For onboarded projects, the extension directs the agent to report legitimate Atlas rule conflicts.
- The reporter defaults to the package author's GitHub repository and can obtain a GitHub token from environment variables or saved credentials.
- The reporter sends the issue body to GitHub with that token and calls the send function when a token is available.
- The CLI exposes the reporter as `atlas report`.
- The extension’s report instruction is conditional on an Atlas rule or gate blocking legitimate work.
Evidence against
- The report is conditional on a particular project conflict, and the package has no npm lifecycle hook that runs it automatically.
- The reporter is a package-aligned issue-reporting feature, and its instructions ask for abstract design details rather than business data.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flagged · loading sourcebin/atlas.jsView file
•matchType = normalized_sha256
matchedPackage = atlas-project-harness@0.1.0-beta.23
matchedPath = bin/atlas.js
matchedIdentity = npm:YXRsYXMtcHJvamVjdC1oYXJuZXNz:0.1.0-beta.23
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/atlas.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = f0d06108f821c11e
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = atlas-project-harness@0.1.0-beta.23
matchedPath = bin/atlas.js
matchedIdentity = npm:YXRsYXMtcHJvamVjdC1oYXJuZXNz:0.1.0-beta.23
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
bin/atlas.jsView on unpkg1#!/usr/bin/env node
L2: const { spawnSync } = require('child_process');
L3: const path = require('path');
Medium
Dynamic Require
Findings
4 High5 Medium4 Low
HighPayload In Excluded Dirtests/test_shared_kernel.py
HighSemantic Analysis Limitedextensions/pi.ts#virtual:normalized:round1
HighKnown Malware Source Similaritybin/atlas.js
HighKnown Malware Source Fingerprint Signaturebin/atlas.js
MediumDynamic Requirebin/atlas.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperpatches/workflow-skill-routing/apply-patches.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to atlas-project-harness@0.1.0-beta.24.
See all versions of atlas-project-harness for other recorded verdicts.
- Avoid installing atlas-project-harness@0.1.0-beta.24. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.