registry / bigpowers / 2.88.9

bigpowers@2.88.9

73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

bigpowers is a user-invoked skills installer with no npm lifecycle scripts and no hidden network or credential sink in the cited entrypoints. Writing agent skill links happens only after an explicit setup command and confirmation, which matches the package purpose.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

No install or import trigger runs the installer; the user must invoke bigpowers setup or the dashboard CLI.

Impact

No unconsented mutation, credential harvest, remote payload, or exfiltration was identified in the inspected entrypoints.

Mechanism

Setup symlinks package skills and local git-guard hooks into directories the user selects, after a confirmation prompt, and skips destinations that are not already managed symlinks.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json has no preinstall, install, or postinstall hook; the published bins are user-run CLIs.
bigpowers setup and install only load bin/setup.js when the user passes that command.
setup.js asks for a confirmation before syncing skills and installing selected tools.
install-helpers.js refuses to replace a path that is not already a bigpowers-managed symlink.
The Gemini before-tool hook only execs the local git guard script and otherwise returns allow.
The visual dashboard HTTP server defaults to 127.0.0.1 and starts only when server.cjs is the main module.

Evidence against

Global setup can symlink this package's skills and hooks into home directories of many agent tools, but only after the user selects those tools and confirms.
bigpowers update on a global install runs npm install -g bigpowers@latest, which is an explicit user command and not an install lifecycle.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

11 flagged

bin/bigpowers.jsView file

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L5

24try { L25: execSync(cmd, { cwd, stdio: 'inherit' }); L26: } catch (e) { ... L31: L32: // True when this copy runs from the global npm install (not a git clone or npx temp dir). L33: function isGlobalInstall() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bigpowers.jsView on unpkg · L24

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/bigpowers.jsView on unpkg

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bigpowers.jsView on unpkg · L5

bin/setup.jsView file

92return new Promise((resolve, reject) => { L93: const child = spawn(cmd, { cwd: ROOT, shell: true }); L94: let output = '';

High

Shell

Package source references shell execution.

bin/setup.jsView on unpkg · L92

skills/visual-dashboard/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = bigpowers@2.44.0 matchedPath = skills/visual-dashboard/scripts/server.cjs matchedIdentity = npm:YmlncG93ZXJz:2.44.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/visual-dashboard/scripts/server.cjsView on unpkg

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BIGPOWERS_DASHBOARD_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BIGPOWERS_DASHBOARD_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/visual-dashboard/scripts/server.cjsView on unpkg · L1

scripts/lib/install-helpers.jsView file

•path = scripts/lib/install-helpers.js kind = trigger_reachable_excluded_payload sizeBytes = 29742 triggerReachableSource = scripts/lib/install-helpers.js excludedPayload = .[redacted]-tool-git-guard.sh

Critical

Trigger Reachable Excluded Directory Payload

A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.

scripts/lib/install-helpers.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. in(rendereddir, f), path.join(targetdir, f)); } } } { const agentssrc = path.join(reporoot, 'agents.md'); const agentsdst = path.join(homedir, '.kilocode', 'agents.md'); fs.mkdirsync(path.dirname(agentsdst), { recursive: true }); if (fs.existssync(agentssrc)) fs.copyfilesync(agentssrc, agentsdst); } break; case 'trae': linkrenderedskills(path.join(reporoot, '.trae/skills'), path.join(homedir, '.trae', 'skills')); { const agentssrc = path.join(reporoot, 'agents.md'); const agentsdst = path.join(homedir, '.trae', 'agents.md'); fs.mkdirsync(path.dirname

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/lib/install-helpers.jsView on unpkg

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView file

•path = .[redacted]-tool-git-guard.sh kind = payload_in_excluded_dir sizeBytes = 669 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView on unpkg

•path = .[redacted]-tool-git-guard.sh kind = build_helper sizeBytes = 669 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.gemini/extensions/bigpowers/hooks/before-tool-git-guard.shView on unpkg

Source & flagged code

11 flagged · loading source

bin/bigpowers.jsView file

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L5

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bigpowers.jsView on unpkg · L24

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/bigpowers.jsView on unpkg

5L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

Findings

1 Critical7 High5 Medium4 Low

CriticalTrigger Reachable Excluded Directory Payloadscripts/lib/install-helpers.js

HighChild Processbin/bigpowers.js

HighShellbin/setup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/lib/install-helpers.js

HighRuntime Package Installbin/bigpowers.js

HighPayload In Excluded Dir.gemini/extensions/bigpowers/hooks/before-tool-git-guard.sh

HighSemantic Analysis Limitedbin/bigpowers.js

HighKnown Malware Source Similarityskills/visual-dashboard/scripts/server.cjs

MediumDynamic Requirebin/bigpowers.js

MediumNetwork

MediumEnvironment Vars

Medium

Affected versions and remediation

This report applies to bigpowers@2.88.9.

See all versions of bigpowers for other recorded verdicts.

Review the evidence and your use of bigpowers@2.88.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 20:37:50.121Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.