registry / brettai / 0.2.8

brettai@0.2.8

Brett — coding agent

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious payload was found, but the package has a broad interactive coding-agent surface. The main unresolved risk is runtime self-update plus remote-model-mediated command and diff workflows.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs the brett CLI, logs in, asks it to work on a project, accepts commands/diffs, or starts it from node_modules when a newer npm version exists.

Impact

May execute approved local commands, read user-mentioned project files, write accepted diffs, upload transcripts/outputs to its platform, and replace the global package with the latest npm release.

Mechanism

Interactive AI agent with network chat, gated shell execution, reviewed diff application, transcript sync, and runtime npm self-update.

Attack narrative

When the user runs brett, the CLI logs in through Supabase, streams chat to the Brett platform, can read selected repository files, can execute gated shell commands requested by the assistant, and can apply reviewed diffs. It also checks registry.npmjs.org and may run npm install -g brettai@latest --force automatically when installed from node_modules. These are dangerous capabilities, but source inspection shows them as visible interactive coding-agent behavior rather than stealth malware.

Rationale

Static inspection found a high-risk AI coding-agent design, especially self-update and shell/diff features, but no unconsented install-time execution or covert exfiltration beyond package-aligned logged-in agent workflows. Treat as warning-worthy dangerous capability rather than malicious malware.

Evidence

package.jsondist/index.js~/.brett/auth.json~/.brett/prefs.jsonuser-mentioned project filesaccepted diff target paths

Network endpoints4

szocqslnprdbvmwmsamf.supabase.covericlaw-coding-agent-production.up.railway.appregistry.npmjs.org/localhost:8000

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js runs user/AI-requested shell commands via child_process exec with command output sent back into the chat flow
dist/index.js can apply model-produced unified diffs to project files after interactive acceptance
dist/index.js auto-checks npm registry and can run npm install -g brettai@latest --force at runtime when installed under node_modules
dist/index.js posts transcripts, command output, selected file contents, memory, and billing/account requests to the Brett platform

Evidence against

package.json has no install/preinstall/postinstall lifecycle scripts
bin entry is an interactive coding-agent CLI; shell, file read, diff write, and network behavior are core product features
command execution is gated: network tools are banned, destructive commands require confirmation, and diff writes go through review UI
Supabase JWT is an anon key used for login; credentials are user-entered only on brett login and stored under ~/.brett/auth.json
No evidence of stealth credential harvesting, persistence, destructive payloads, dependency confusion, or import-time execution

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 57.7 KB of source, external domains: registry.npmjs.org, szocqslnprdbvmwmsamf.supabase.co, vericlaw-coding-agent-production.up.railway.app

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2var ar=Object.defineProperty;var Ot=(e,t)=>()=>(e&&(t=e(e=0)),t);var Ee=(e,t)=>{for(var n in t)ar(e,n,{get:t[n],enumerable:!0})};import{readFileSync as Sr,writeFileSync as Cr,mkdirSync as $r,existsSync as Pr,chmodSync as _r}from"fs";import{homedir as Rr}from"os";import{join as He}from"path";function Ge(){return process.env.SUPABASE_URL??"https://szocqslnprdbvmwmsamf.supabase.co"}function ze(){return process.env.SUPABASE_ANON_KEY??"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InN6b2Nxc2xucHJkYnZtd21zYW1mIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODEyMTI1NjcsImV4cCI6MjA5Njc4ODU2N30. ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L2

3${t}`,o=r.match(/Logged in to [\w.]+ account (\S+)/i)||r.match(/Logged in to [\w.]+ as (\S+)/i);return n===0&&o?{installed:!0,authed:!0,account:o[1],detail:`Connected as ${o[1]}`}:n===0&&/Logged in/i.test(r)?{installed:!0,authed:!0,detail:"Connected to GitHub"}:{installed:!0,authed:!1,detail:"installed but not signed in"}}async function vo(){try{await Sn("gh --version",{timeout:1e4})}catch{return{installed:!1,authed:!1,detail:"not connected \u2014 needs the GitHub CLI"}}try{let{stdout:e,stderr:t}=await Sn("gh auth status",{timeout:1e4});return Cn(e,t,0)}catch(e){return Cn(e.stdout??"",e.stderr ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

4`)}async function Pn(e){let t=et[e];if(!t)return`Unknown connector "${e}". Available: ${Object.keys(et).join(", ")}.`;let n=await t.check();return n.authed?`${t.name}: ${n.detail}. You're all set

5`):[`${t.name}: the GitHub CLI isn't installed yet.`,"","To connect GitHub:"," 1. Quit Brett (type /quit)"," 2. Install: winget install GitHub.cli"," 3. Run: gh auth login"," 4. Start Brett again","","GitHub is optional \u2014 everything else works without it."].join(`

6`)}var Sn,et,Gt=Ot(()=>{"use strict";Sn=To(ko);et={github:{id:"github",name:"GitHub",check:vo,setupHint:`Brett uses the GitHub CLI for branches, commits, and pull requests.

7 1. winget install GitHub.cli

8 2. gh auth login

9Once signed in, ask Brett to commit changes or open a PR.`}}});var be={};Ee(be,{runConnect:()=>Jo});import{spawnSync as Vo}from"child_process";async function Jo(e){if(!e){for(let o of Object.values(et)){let s=await o.check(),i=s.authed?"\u2713

10Usage: brett connect <name> (e.g. brett connect github)

12For GitHub, just run: gh auth login`);return}let t=e.toLowerCase(),n=et[t];if(!n){console.log(`Unknown connector: ${e}`),console.log(`Available: ${Object.keys(et).join(", ")}`);return}let r=await n.check();if(r.authed){console.log(`${

13`),console.log(" Install: winget install GitHub.cli"),console.log(" Then run: gh auth login");return}console.log(`Signing in to GitHub...

14`),Vo("gh",["auth","login"],{stdio:"inherit"}).status===0?console.log(`

15GitHub connected! Start brett and it can create branches, commits, and PRs.`):console.log(`

16Sign-in was not completed. Try again: gh auth login`);return}console.log(`${n.name} setup:

18${n.setupHint}`)}var ye=Ot(()=>{"use strict";Gt()});var qn={};Ee(qn,{runLogin:()=>Xo});import*as zn from"readline";async function Xo(){let e=zn.createInterface({input:process.stdin,output:process.stdout}),t=o=>new

19`);let n=await t("Email: "),r=await t("Password: ");e.close();try{let o=await Je(n.trim(),r);console.log(`

20Logged in as ${o.email}. Token stored in ~/.brett/auth.json`)}catch(o){console.error(`

21${o instanceof Error?o.message:"Login failed"}`),process.exitCode=1}}var Vn=Ot(()=>{"use strict";vt()});import"dotenv/config";import{render as Yo}from"ink";import{execSync as Jn}from"child_process";import{createInterface as Ko}from"readline"

22`),n=[],r=0,o=0,s=!1,i=[],c=[],u=()=>{let a=Math.max(i.length,c.length);for(let d=0;d<a;d++){let p=i[d],h=c[d];n.push({leftNo:p?String(p.no):"",leftContent:p?p.content:"",leftType:p?"removed":"empty",rightNo:h?String(h.no):"",rightContent:h?h.content:"",rightType:h?"added":"empty"})}i=[],c=[]};for(let a of t){if(a.startsWith("diff ")||a.startsWith("index ")){u(),n.push({leftNo:"",leftContent:a,leftType:"header",rightNo:"",rightContent:"",rightType:"empty"});continue}if(a.startsWith("---")){u(),n.push({leftNo:"",leftContent:a,leftType:"header",rightNo:"",rightContent:"",rightType:"empty"});cont ...

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2patternName = supabase_service_key severity = critical line = 2 matchedText = var ar=O...${e}

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = supabase_service_key severity = critical line = 2 matchedText = var ar=O...${e}

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L2

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var ar=Object.defineProperty;var Ot=(e,t)=>()=>(e&&(t=e(e=0)),t);var Ee=(e,t)=>{for(var n in t)ar(e,n,{get:t[n],enumerable:!0})};import{readFileSync as Sr,writeFileSync as Cr,mkdir... L3: ${t}`,o=r.match(/Logged in to [\w.]+ account (\S+)/i)||r.match(/Logged in to [\w.]+ as (\S+)/i);return n===0&&o?{installed:!0,authed:!0,account:o[1],detail:`Connected as ${o[1]}`}:... L4: `)}async function Pn(e){let t=et[e];if(!t)return`Unknown connector "${e}". Available: ${Object.keys(et).join(", ")}.`;let n=await t.check();return n.authed?`${t.name}: ${n.detail}....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

2 Critical3 High2 Medium4 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L2

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

4`)}async function Pn(e){let t=et[e];if(!t)return`Unknown connector "${e}". Available: ${Object.keys(et).join(", ")}.`;let n=await t.check();return n.authed?`${t.name}: ${n.detail}. You're all set

6`)}var Sn,et,Gt=Ot(()=>{"use strict";Sn=To(ko);et={github:{id:"github",name:"GitHub",check:vo,setupHint:`Brett uses the GitHub CLI for branches, commits, and pull requests.

7 1. winget install GitHub.cli

8 2. gh auth login

10Usage: brett connect <name> (e.g. brett connect github)

13`),console.log(" Install: winget install GitHub.cli"),console.log(" Then run: gh auth login");return}console.log(`Signing in to GitHub...

14`),Vo("gh",["auth","login"],{stdio:"inherit"}).status===0?console.log(`

15GitHub connected! Start brett and it can create branches, commits, and PRs.`):console.log(`

16Sign-in was not completed. Try again: gh auth login`);return}console.log(`${n.name} setup:

19`);let n=await t("Email: "),r=await t("Password: ");e.close();try{let o=await Je(n.trim(),r);console.log(`

20Logged in as ${o.email}. Token stored in ~/.brett/auth.json`)}catch(o){console.error(`

Long lines were clipped for display.