registry  /  bizcoder  /  0.3.96

bizcoder@0.3.96

BizCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A user-invoked launcher selects and executes an opaque platform binary supplied by an optional dependency. No install-time execution or confirmed exfiltration is present in this package source.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the `bizcoder` command after installation.
Impact
The platform-specific optional package can run arbitrary native code outside this archive's inspectable source.
Mechanism
Dynamic optional-dependency binary resolution followed by child-process execution.
Rationale
No concrete malicious behavior is established in the inspected source, but the package is an opaque native-payload carrier whose actual executable is delegated to optional dependencies. Flag for warning rather than block.
Evidence
package.jsonbin/bizcoder.mjsREADME.md

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • `bin/bizcoder.mjs` dynamically resolves a platform-specific optional dependency binary.
  • `bin/bizcoder.mjs` executes that resolved binary with `spawnSync` and inherited stdio.
  • `package.json` contains only the launcher; the executable payload is absent from this archive.
  • `README.md` describes unrelated OpenCode software and installation commands, conflicting with the BizCoder manifest.
Evidence against
  • `package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
  • The launcher runs only when the user invokes the `bizcoder` CLI.
  • No network, credential harvesting, file writes, shell interpolation, eval, or persistence code appears in inspected source.
  • Platform packages are explicit version-matched optional dependencies in `package.json`.
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 1.08 KB of source, external domains: bizcoder.ai

Source & flagged code

2 flagged · loading source
bin/bizcoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/bizcoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L17: console.error(`BizCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L18: console.error(`해결: npm install -g bizcoder --force · 안내: https://bizcoder.ai/cli/`) L19: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/bizcoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/bizcoder.mjs
HighShell
HighRuntime Package Installbin/bizcoder.mjs
LowUrl Strings