registry  /  bizcoder  /  0.3.64

bizcoder@0.3.64

BizCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

This package is a thin CLI launcher that resolves and executes a platform-specific optional dependency binary. Static inspection of this wrapper found no install-time behavior or confirmed malicious logic.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the bizcoder CLI
Impact
Delegates behavior to platform package; this wrapper itself shows no confirmed attack behavior
Mechanism
spawnSync of resolved optional-dependency binary with inherited stdio
Rationale
The suspicious primitives are package-aligned for a platform-binary CLI launcher and are only activated by explicit user command. No lifecycle hook, exfiltration, persistence, destructive action, remote payload fetch, or AI-agent control-surface mutation is present in the inspected source.
Evidence
package.jsonbin/bizcoder.mjs
Network endpoints3
bizcoder.aigithub.com/latemonk/bizcoder-cli.gitbizcoder.ai/cli/

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
  • bin/bizcoder.mjs uses spawnSync to execute a platform optional-dependency binary with user CLI args
  • package.json declares optional platform packages bizcoder-<platform>-<arch>, so executed code is outside this wrapper package
Evidence against
  • package.json has no preinstall/install/postinstall/prepare lifecycle scripts
  • bin/bizcoder.mjs only runs when the bizcoder CLI is invoked, not at install or import time
  • No credential/env harvesting, file traversal, persistence, destructive code, eval/vm/Function, or network calls found in package source
  • Runtime package-install scanner hint is only an error message suggesting npm install -g --force; no install command is executed
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 866 B of source, external domains: bizcoder.ai

Source & flagged code

2 flagged · loading source
bin/bizcoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/bizcoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`BizCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g bizcoder --force · 안내: https://bizcoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bizcoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/bizcoder.mjs
HighShell
HighRuntime Package Installbin/bizcoder.mjs
LowUrl Strings