AI Security Review
scanned 2h ago · by lpm-firewall-aiA user-invoked launcher selects and executes an opaque platform binary supplied by an optional dependency. No install-time execution or confirmed exfiltration is present in this package source.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the `bizcoder` command after installation.
Impact
The platform-specific optional package can run arbitrary native code outside this archive's inspectable source.
Mechanism
Dynamic optional-dependency binary resolution followed by child-process execution.
Rationale
No concrete malicious behavior is established in the inspected source, but the package is an opaque native-payload carrier whose actual executable is delegated to optional dependencies. Flag for warning rather than block.
Evidence
package.jsonbin/bizcoder.mjsREADME.md
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- `bin/bizcoder.mjs` dynamically resolves a platform-specific optional dependency binary.
- `bin/bizcoder.mjs` executes that resolved binary with `spawnSync` and inherited stdio.
- `package.json` contains only the launcher; the executable payload is absent from this archive.
- `README.md` describes unrelated OpenCode software and installation commands, conflicting with the BizCoder manifest.
Evidence against
- `package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
- The launcher runs only when the user invokes the `bizcoder` CLI.
- No network, credential harvesting, file writes, shell interpolation, eval, or persistence code appears in inspected source.
- Platform packages are explicit version-matched optional dependencies in `package.json`.
Behavioral surface
ChildProcessShell
UrlStrings
Source & flagged code
2 flagged · loading sourcebin/bizcoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
High
3// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
...
L17: console.error(`BizCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`)
L18: console.error(`해결: npm install -g bizcoder --force · 안내: https://bizcoder.ai/cli/`)
L19: process.exit(1)
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/bizcoder.mjsView on unpkg · L3Findings
3 High1 Low
HighChild Processbin/bizcoder.mjs
HighShell
HighRuntime Package Installbin/bizcoder.mjs
LowUrl Strings