registry / auditx / 0.1.9

auditx@0.1.9

One command. Every vulnerability. AI-ready markdown report.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious behavior, but the CLI has a real command-injection risk from shell-built scanner commands using user-controlled target paths. Network and filesystem writes are mostly package-aligned scanner installation, reports, config, and optional git hooks.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs auditx against a crafted target path or invokes install/hook/ai options

Impact

Potential local command execution via crafted scan path; otherwise expected scanner downloads, report generation, optional hooks, and optional AI summary requests

Mechanism

shell command interpolation and package-aligned scanner orchestration

Attack narrative

A local attacker who can cause a user to scan a directory path containing shell metacharacters could exploit several exec-based runners because targetPath/staged file strings are interpolated into shell commands. This is a vulnerability in a security CLI, not evidence that the package intentionally attacks installs or imports.

Rationale

Static inspection supports a package-aligned security scanner with no lifecycle execution, hidden exfiltration, or persistence, but it also exposes unresolved command-injection risk in shell command construction. Treat as warn rather than publish block because the risky primitives are user-invoked and aligned with scanner functionality.

Evidence

package.jsondist/auditx.jsdist/hook-W4INEOTH.jsREADME.md~/.auditx/bin~/.auditx/semgrep-home~/.auditx/config.jsonaudit-report.md.git/hooks/pre-commit.git/hooks/pre-push.git/hooks/post-merge.git/hooks/post-checkout

Network endpoints3

github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${osStr}_${archStr}.${ext}github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${osStr}-${archStr}.${ext}github.com/semgrep/semgrep/releases/download/v${SEMGREP_VERSION}/semgrep-v${SEMGREP_VERSION}-${osStr}.${ext}

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

dist/auditx.js runs shell commands with interpolated target paths in npx/lizard/tsc/license-checker runners
dist/auditx.js auto-downloads scanner binaries from GitHub into ~/.auditx/bin on user-invoked scans
dist/auditx.js has user-invoked `auditx install` that runs npm install -g and pip install
dist/hook-W4INEOTH.js writes git hooks, but only via explicit `auditx hook install` command

Evidence against

package.json has no install/preinstall/postinstall lifecycle scripts
Bin entrypoint is a security scanner CLI; child_process/network use aligns with invoking Semgrep, Trivy, Gitleaks, npm audit, and report tools
No source evidence of credential harvesting or hidden exfiltration; AI provider calls require --ai and user/env API key
Config writes are limited to ~/.auditx/config.json after interactive AI setup
Git hook mutation is explicit CLI functionality with marker, backup, and uninstall path

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 79.0 KB of source, external domains: github.com, semgrep.dev, trivy.dev

Source & flagged code

5 flagged

dist/auditx.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/bin/auditx.ts

4import { program } from "commander";

5import ora2 from "ora";

6import chalk4 from "chalk";

7import { writeFileSync as writeFileSync2, readFileSync as readFileSync4 } from "fs";

8import { resolve } from "path";

9import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L8

11// src/detect.ts

12import { existsSync } from "fs";

13import { join } from "path";

14function detectStack(targetDir) {

15 const has = (file) => existsSync(join(targetDir, file));

16 const hasGit = has(".git");

17 return {

18 hasNodeJs: has("package.json") || has("package-lock.json") || has("yarn.lock") || has("pnpm-lock.yaml"),

19 hasPython: has("requirements.txt") || has("Pipfile") || has("pyproject.toml") || has("setup.py") || has("setup.cfg"),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L8

20 hasRust: has("Cargo.toml"),

21 hasGo: has("go.mod"),

22 hasDocker: has("Dockerfile") || has("docker-compose.yml") || has("docker-compose.yaml"),

23 hasGit,

24 // Treat any .git dir as having history. Gitleaks will scan it.

25 hasGitHistory: hasGit,

26 hasTerraform: has("main.tf") || has("terraform.tf") || // Check a couple of common subdirectory patterns

27 existsSync(join(targetDir, "infra", "main.tf")) || existsSync(join(targetDir, "terraform", "main.tf")),

28 hasTypeScript: has("tsconfig.json")

Lines 753-801javascript

753 "security/detect-non-literal-require": "warn",

754 "security/detect-non-literal-fs-filename": "warn",

755 "security/detect-unsafe-regex": "error",

756 "security/detect-buffer-noassert": "error",

757 "security/detect-child-process": "warn",

758 "security/detect-disable-mustache-escape": "error",

759

•matchType = previous_version_dangerous_delta matchedPackage = auditx@0.1.5 matchedIdentity = npm:YXVkaXR4:0.1.5 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/auditx.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/auditx.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/auditx.jsView on unpkg

8import { resolve } from "path"; L9: import { execSync } from "child_process"; L10:

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L8

773import { randomUUID as randomUUID2 } from "crypto"; L774: var execAsync = promisify7(exec); L775: async function runJscpd(targetPath, stagedFiles) {

High

Shell

Package source references shell execution.

dist/auditx.jsView on unpkg · L773

781const targets = stagedFiles && stagedFiles.length > 0 ? stagedFiles.map((f) => `"${f}"`).join(" ") : `"${targetPath}"`; L782: await execAsync(`npx --yes jscpd ${targets} --reporters json --output "${tmpDir}" --silent`, { maxBuffer: 10 * 1024 * 1024 }); L783: } catch (e) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auditx.jsView on unpkg · L781

8import { resolve } from "path"; L9: import { execSync } from "child_process"; L10: ... L17: return { L18: hasNodeJs: has("package.json") || has("package-lock.json") || has("yarn.lock") || has("pnpm-lock.yaml"), L19: hasPython: has("requirements.txt") || has("Pipfile") || has("pyproject.toml") || has("setup.py") || has("setup.cfg"), ... L50: import { existsSync as existsSync2, mkdirSync, createWriteStream, rmSync } from "fs"; L51: import https from "https"; L52: import * as tar from "tar"; ... L61: function getSemgrepEnv() { L62: const semgrepHome = join2(homedir(), ".auditx", "semgrep-home"); L63: if (!existsSync2(semgrepHome)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L8

Findings

1 Critical3 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/auditx.js

HighChild Processdist/auditx.js

HighShelldist/auditx.js

HighRuntime Package Installdist/auditx.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/auditx.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/auditx.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/bin/auditx.ts

4import { program } from "commander";

5import ora2 from "ora";

6import chalk4 from "chalk";

7import { writeFileSync as writeFileSync2, readFileSync as readFileSync4 } from "fs";

8import { resolve } from "path";

9import { execSync } from "child_process";

High

Child Process

Package source references child process execution.

dist/auditx.jsView on unpkg · L8

11// src/detect.ts

12import { existsSync } from "fs";

13import { join } from "path";

14function detectStack(targetDir) {

15 const has = (file) => existsSync(join(targetDir, file));

16 const hasGit = has(".git");

17 return {

18 hasNodeJs: has("package.json") || has("package-lock.json") || has("yarn.lock") || has("pnpm-lock.yaml"),

19 hasPython: has("requirements.txt") || has("Pipfile") || has("pyproject.toml") || has("setup.py") || has("setup.cfg"),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/auditx.jsView on unpkg · L8

20 hasRust: has("Cargo.toml"),

21 hasGo: has("go.mod"),

22 hasDocker: has("Dockerfile") || has("docker-compose.yml") || has("docker-compose.yaml"),

23 hasGit,

24 // Treat any .git dir as having history. Gitleaks will scan it.

25 hasGitHistory: hasGit,

26 hasTerraform: has("main.tf") || has("terraform.tf") || // Check a couple of common subdirectory patterns

27 existsSync(join(targetDir, "infra", "main.tf")) || existsSync(join(targetDir, "terraform", "main.tf")),

28 hasTypeScript: has("tsconfig.json")

Lines 753-801javascript

753 "security/detect-non-literal-require": "warn",

754 "security/detect-non-literal-fs-filename": "warn",

755 "security/detect-unsafe-regex": "error",

756 "security/detect-buffer-noassert": "error",

757 "security/detect-child-process": "warn",

758 "security/detect-disable-mustache-escape": "error",

759

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/auditx.jsView on unpkg