registry / autodev-ai / 0.1.40

autodev-ai@0.1.40

AutoDev — Autonomous Engineering Team. DevTeam in a Box. Runs on pi.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

No confirmed malicious attack surface by source inspection. The package is a broad AI-agent CLI/extension with powerful user-invoked setup, update, docs, and onboarding actions, but reviewed risky behavior is aligned with that purpose.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs install.sh or autodev subcommands such as doctor, init, config, update, docs rebuild, onboard, or uninstall.

Impact

Can modify local AutoDev/project config and contact configured provider services when explicitly run; no unconsented lifecycle execution or credential exfiltration found.

Mechanism

User-invoked agent framework setup and orchestration

Rationale

Static inspection found high-risk primitives, but they are explicit CLI/installer features for an AI-agent framework and are not activated by npm lifecycle/import. No hidden persistence, unconsented agent control mutation, credential harvesting, or non-aligned exfiltration path was confirmed.

Evidence

package.jsoninstall.shscripts/cli.tsscripts/onboard.tsAGENTS.mdextensions/autodev/installer/config-module.tsextensions/autodev/installer/tools.tsextensions/autodev/installer/install-module.tsextensions/autodev/installer/init-module.tsextensions/autodev/installer/key-validator.tsextensions/autodev/docs/seeding.tsextensions/autodev/embeddings.ts~/.AutoDev/agent/.env~/.AutoDev/agent/auth.json~/.AutoDev/agent/models.json~/.AutoDev/config/docs-sources.yaml~/.config/cortexkit/magic-context.jsoncCONTEXT.md.autodev/project.autodev/config/models.json.github/ISSUE_TEMPLATE/autodev-request.md

Network endpoints11

bun.sh/installraw.githubusercontent.com/Homebrew/install/HEAD/install.shollama.com/api/tagsollama.com/v1api.openai.com/v1/modelsapi.anthropic.com/v1/modelsgenerativelanguage.googleapis.com/v1beta/modelsapi.voyageai.com/v1/embeddingsdiscord.com/api/v10/users/@mecli.github.com/packagesdeb.nodesource.com/setup_lts.x

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with high false-positive risk.

Evidence for block

User-invoked CLI can run shell/package-manager commands: scripts/cli.ts, installer/tools.ts, installer/init-module.ts.
autodev init can write project AGENTS.md/CONTEXT.md and .autodev files from bundled templates.
AGENTS.md contains AI-agent operating instructions, but is bundled documentation/config for this agent framework.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks; bin is explicit autodev CLI.
Credential prompts store keys locally in agent .env/auth references; validation calls provider APIs, no off-domain exfil flow found.
Network endpoints are package-aligned: npm registry, GitHub/gh, LLM/Voyage/Discord validation, docs seeding from configured sources.
Homebrew curl|bash and package installs occur only via installer/doctor/update/tool commands, not import-time or install-time.
Debug test secret is synthetic and logger redacts secrets before writing.
AI-agent control files are written only on user-invoked init/install/onboard, not silently during package install/import.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 90 file(s), 645 KB of source, external domains: api.anthropic.com, api.context7.com, api.openai.com, api.voyageai.com, bun.sh, cli.github.com, deb.nodesource.com, discord.com, generativelanguage.googleapis.com, github.com, grep.app, ollama.com, raw.githubusercontent.com

Source & flagged code

11 flagged

extensions/autodev/debug/__tests__/debug.test.tsView file

Lines 226-267typescript

226 // The raw secret should NOT appear anywhere in the log

227 expect(content).not.toContain("sk-ant-abcdefghijklmnopqrstuvwxyz123456");

228

229 rmSync(dir, { recursive: true, force: true });

230});

231

232test("multiple secret patterns are redacted", async () => {

233 const dir = tmpDir();

234 const logPath = join(dir, "debug.log");

235 process.env.AUTODEV_DEBUG = "true";

236 process.env.AUTODEV_DEBUG_LOG = logPath;

237

238 const logger = getLogger();

239 logger.log({

240 timestamp: "t1",

241 level: "info",

242 event: "test",

243 data: {

244 anthropic: "sk-ant-abcdefghijklmnopqrstuvwxyz123456",

245 openrouter: "sk-or-abcdefghijklmnopqrstuvwxyz123456",

246 google: "AIzaSyDfi9nT6m1234567890ABCDEFGHIJKLMNOPQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

247 github: "ghp_abcdefghijklmnopqrstuvwxyz12345678901234",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

248 slack: "xoxb-abcdefghijklmnopqrstuvwxyz1234",

249 jwt: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPnd9dGQm4kFy8QkZ5xGc",

250 },

251 });

252

253 await new Promise((r) => setTimeout(r, 100));

254

255 const content = await readFile(logPath, "utf-8");

256 const parsed = JSON.parse(content.trim());

257

258 expect(parsed.data.anthropic).toBe("[REDACTED]");

259 expect(parsed.data.openrouter).toBe("[REDACTED]");

260 expect(parsed.data.google).toBe("[REDACTED]");

261 expect(parsed.data.github).toBe("[REDACTED]");

262 expect(parsed.data.slack).toBe("[REDACTED]");

263 expect(parsed.data.jwt).toBe("[REDACTED]");

264

265 rmSync(dir, { recursive: true, force: true });

266});

267

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

extensions/autodev/background/manager.tsView file

Lines 130-170typescript

130 private maxFor(key: string): number {

131 return this.concurrencyConfig[key]?.max ?? DEFAULT_MAX_CONCURRENCY;

132 }

133

134 private running(key: string): number {

135 return this.runningPerKey.get(key) ?? 0;

extensions/autodev/docs/seeding.tsView file

Lines 174-214typescript

174 }

175

176 const destDir = join(centralCorpusRoot(), source.targetSubdir);

177 mkdirSync(destDir, { recursive: true });

178 return copyMdFiles(srcDir, destDir, source.excludePatterns, source.targetSubdir);

179 } finally {

180

extensions/autodev/installer/uninstall-module.tsView file

Lines 3-43typescript

4export interface UninstallResult {

5 readonly name: string;

6 readonly ok: boolean;

7 readonly detail: string;

extensions/autodev/embeddings.tsView file

Lines 17-57typescript

18// ---------------------------------------------------------------------------

19// Types

20// ---------------------------------------------------------------------------

22/** Injectable embedding function. Tests pass a deterministic mock. */

23export type EmbedFn = (texts: string[], isQuery?: boolean) =>

extensions/autodev/installer/tools.tsView file

Lines 1-21typescript

1import { execSync, type ExecSyncOptions } from "node:child_process";

2import { platform } from "node:os";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

4export type Platform = "darwin" |

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

extensions/autodev/installer/config-module.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = autodev-ai@0.1.39 matchedIdentity = npm:YXV0b2Rldi1haQ:0.1.39 similarity = 0.989 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

extensions/autodev/installer/config-module.tsView on unpkg

Source & flagged code

11 flagged · loading source

extensions/autodev/debug/__tests__/debug.test.tsView file

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

246patternName = google_api_key severity = high line = 246 matchedText = google: ...PQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

extensions/autodev/background/manager.tsView file

150L151: spawn(config: SpawnConfig): string { L152: const id = this.nextId();

High

Child Process

Package source references child process execution.

extensions/autodev/background/manager.tsView on unpkg · L150

extensions/autodev/docs/seeding.tsView file

194const mdUrls: string[] = []; L195: let match: RegExpExecArray | null; L196: while ((match = linkRegex.exec(indexText)) !== null) {

High

Shell

Package source references shell execution.

extensions/autodev/docs/seeding.tsView on unpkg · L194

extensions/autodev/installer/uninstall-module.tsView file

181try { L182: const { execSync } = await import("node:child_process"); L183: const cmd = `npx @earendil-works/pi-coding-agent uninstall ${source}`; L184: execSync(cmd, { stdio: "pipe", timeout: 60_000, cwd: process.cwd() });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

extensions/autodev/installer/uninstall-module.tsView on unpkg · L181

23const SHELL_RC_CANDIDATES = [ L24: ".bashrc", L25: ".zshrc", ... L55: const { notify } = deps; L56: const home = process.env.HOME ?? "~"; L57: const targets = [ ... L181: try { L182: const { execSync } = await import("node:child_process"); L183: const cmd = `npx @earendil-works/pi-coding-agent uninstall ${source}`; L184: execSync(cmd, { stdio: "pipe", timeout: 60_000, cwd: process.cwd() }); L185: notify(`Uninstalled ${source}`, "info");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

extensions/autodev/installer/uninstall-module.tsView on unpkg · L23

extensions/autodev/embeddings.tsView file

37): Promise<Float32Array[]> { L38: const apiKey = process.env.VOYAGE_API_KEY; L39: if (!apiKey) throw new Error("VOYAGE_API_KEY not set"); ... L42: const batch = texts.slice(i, i + VOYAGE_BATCH_SIZE); L43: const res = await fetch("https://api.voyageai.com/v1/embeddings", { L44: method: "POST", ... L48: }, L49: body: JSON.stringify({ L50: model: "voyage-3", ... L55: if (!res.ok) { L56: throw new Error(`VoyageAI embeddings failed: ${res.status} ${await res.text()}`); L57: }

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

extensions/autodev/embeddings.tsView on unpkg · L37

extensions/autodev/installer/tools.tsView file

1import { execSync, type ExecSyncOptions } from "node:child_process"; L2: import { platform } from "node:os"; ... L59: function isNonInteractive(): boolean { L60: if (process.env.CI === "true" || process.env.CI === "1") return true; L61: if (process.stdout != null && process.stdout.isTTY === false) return true; L62: if (process.argv.includes("--yes") || process.argv.includes("-y")) return true; ... L65: L66: const HOMEBREW_BOOTSTRAP_URL = "https://raw.githubusercontent.[redacted].sh"; L67: ... L108: notify(`Installing Homebrew from ${HOMEBREW_BOOTSTRAP_URL}...`, "info"); L109: exec(`bash -c 'NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL ${HOMEBREW_BOOTSTRAP_URL})"`, { L110: stdio: "inherit",

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

extensions/autodev/installer/config-module.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

extensions/autodev/installer/config-module.tsView on unpkg

Findings

4 Critical5 High5 Medium4 Low

CriticalCritical Secretextensions/autodev/debug/__tests__/debug.test.ts

CriticalDownload Executeextensions/autodev/installer/tools.ts

CriticalPrevious Version Dangerous Deltaextensions/autodev/installer/config-module.ts

CriticalSecret Patternextensions/autodev/debug/__tests__/debug.test.ts

HighChild Processextensions/autodev/background/manager.ts

HighShellextensions/autodev/docs/seeding.ts

HighCredential Exfiltrationextensions/autodev/embeddings.ts

HighRuntime Package Installextensions/autodev/installer/uninstall-module.ts

HighSecret Patternextensions/autodev/debug/__tests__/debug.test.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceextensions/autodev/installer/uninstall-module.ts

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

extensions/autodev/debug/__tests__/debug.test.tsView file

Lines 226-267typescript

226 // The raw secret should NOT appear anywhere in the log

227 expect(content).not.toContain("sk-ant-abcdefghijklmnopqrstuvwxyz123456");

228

229 rmSync(dir, { recursive: true, force: true });

230});

231

232test("multiple secret patterns are redacted", async () => {

233 const dir = tmpDir();

234 const logPath = join(dir, "debug.log");

235 process.env.AUTODEV_DEBUG = "true";

236 process.env.AUTODEV_DEBUG_LOG = logPath;

237

238 const logger = getLogger();

239 logger.log({

240 timestamp: "t1",

241 level: "info",

242 event: "test",

243 data: {

244 anthropic: "sk-ant-abcdefghijklmnopqrstuvwxyz123456",

245 openrouter: "sk-or-abcdefghijklmnopqrstuvwxyz123456",

246 google: "AIzaSyDfi9nT6m1234567890ABCDEFGHIJKLMNOPQ",

High

Secret Pattern

Google API key in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L246

247 github: "ghp_abcdefghijklmnopqrstuvwxyz12345678901234",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

248 slack: "xoxb-abcdefghijklmnopqrstuvwxyz1234",

249 jwt: "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPnd9dGQm4kFy8QkZ5xGc",

250 },

251 });

252

253 await new Promise((r) => setTimeout(r, 100));

254

255 const content = await readFile(logPath, "utf-8");

256 const parsed = JSON.parse(content.trim());

257

258 expect(parsed.data.anthropic).toBe("[REDACTED]");

259 expect(parsed.data.openrouter).toBe("[REDACTED]");

260 expect(parsed.data.google).toBe("[REDACTED]");

261 expect(parsed.data.github).toBe("[REDACTED]");

262 expect(parsed.data.slack).toBe("[REDACTED]");

263 expect(parsed.data.jwt).toBe("[REDACTED]");

264

265 rmSync(dir, { recursive: true, force: true });

266});

267

247patternName = github_pat severity = critical line = 247 matchedText = github: ...34",

Critical

Secret Pattern

GitHub personal access token in extensions/autodev/debug/__tests__/debug.test.ts

extensions/autodev/debug/__tests__/debug.test.tsView on unpkg · L247

extensions/autodev/background/manager.tsView file

Lines 130-170typescript

130 private maxFor(key: string): number {

131 return this.concurrencyConfig[key]?.max ?? DEFAULT_MAX_CONCURRENCY;

132 }

133

134 private running(key: string): number {

135 return this.runningPerKey.get(key) ?? 0;

extensions/autodev/docs/seeding.tsView file

Lines 174-214typescript

174 }

175

176 const destDir = join(centralCorpusRoot(), source.targetSubdir);

177 mkdirSync(destDir, { recursive: true });

178 return copyMdFiles(srcDir, destDir, source.excludePatterns, source.targetSubdir);

179 } finally {

180

extensions/autodev/installer/uninstall-module.tsView file

Lines 3-43typescript

4export interface UninstallResult {

5 readonly name: string;

6 readonly ok: boolean;

7 readonly detail: string;

extensions/autodev/embeddings.tsView file

Lines 17-57typescript

18// ---------------------------------------------------------------------------

19// Types

20// ---------------------------------------------------------------------------

22/** Injectable embedding function. Tests pass a deterministic mock. */

23export type EmbedFn = (texts: string[], isQuery?: boolean) =>

extensions/autodev/installer/tools.tsView file

Lines 1-21typescript

1import { execSync, type ExecSyncOptions } from "node:child_process";

2import { platform } from "node:os";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

extensions/autodev/installer/tools.tsView on unpkg · L1

4export type Platform = "darwin" |

install.shView file

•path = install.sh kind = build_helper sizeBytes = 2692 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

extensions/autodev/installer/config-module.tsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

extensions/autodev/installer/config-module.tsView on unpkg