registry / brettai / 0.3.0

brettai@0.3.0

Brett — coding agent

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was found, but the package is an AI coding-agent CLI with shell execution, repository file mutation, remote chat/transcript sync, and self-update behavior. These capabilities are package-aligned and user-invoked rather than install-time compromise.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `brett`, `brett login`, `brett connect`, or approves agent actions in the CLI.

Impact

Can read project files, modify repository files, execute approved commands, save session transcripts remotely, and update itself when launched from a global install.

Mechanism

user-invoked coding agent with gated shell execution, reviewed file writes, remote API sync, and package self-update

Rationale

Source inspection supports a warning for dangerous AI-agent capabilities and package-owned self-update, but not a publish block because execution and file mutation are user-invoked and guarded with no install-time malicious behavior found. Network endpoints and stored tokens are aligned with the Brett CLI service.

Evidence

package.jsondist/index.js~/.brett/auth.json~/.brett/prefs.jsonuser-selected repository files

Network endpoints3

szocqslnprdbvmwmsamf.supabase.covericlaw-coding-agent-production.up.railway.appregistry.npmjs.org/brettai/latest

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js is a coding-agent CLI that can execute model-proposed shell commands via child_process.exec after gating/permission checks.
dist/index.js applies AI-generated diffs to project files with writeFileSync after interactive review.
dist/index.js self-updates at CLI startup from node_modules via `npm install -g brettai@latest --force`.
dist/index.js sends chat, transcripts, memory, billing, and identity requests to package platform endpoints.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
bin entry is explicit user-invoked CLI `brett`; no install-time execution found.
Command execution blocks network tools and write primitives, warns on destructive commands, and asks permission unless auto/full mode is selected.
Path writes are constrained to the selected repository root and reviewed as diffs.
Supabase JWT-like value is an anon key used for package login, not a private credential harvested from users.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 60.6 KB of source, external domains: registry.npmjs.org, szocqslnprdbvmwmsamf.supabase.co, vericlaw-coding-agent-production.up.railway.app

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2var Er=Object.defineProperty;var Vt=(t,e)=>()=>(t&&(e=t(t=0)),e);var en=(t,e)=>{for(var n in e)Er(t,n,{get:e[n],enumerable:!0})};import{readFileSync as qr,writeFileSync as Vr,mkdirSync as Jr,existsSync as Xr,chmodSync as Yr}from"fs";import{homedir as Kr}from"os";import{join as pn}from"path";function gn(){return process.env.SUPABASE_URL??"https://szocqslnprdbvmwmsamf.supabase.co"}function yn(){return process.env.SUPABASE_ANON_KEY??"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InN6b2Nxc2xucHJkYnZtd21zYW1mIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODEyMTI1NjcsImV4cCI6MjA5Njc4ODU2N30. ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L2

3${e}`,o=r.match(/Logged in to [\w.]+ account (\S+)/i)||r.match(/Logged in to [\w.]+ as (\S+)/i);return n===0&&o?{installed:!0,authed:!0,account:o[1],detail:`Connected as ${o[1]}`}:n===0&&/Logged in/i.test(r)?{installed:!0,authed:!0,detail:"Connected to GitHub"}:{installed:!0,authed:!1,detail:"installed but not signed in"}}async function qo(){try{await qn("gh --version",{timeout:1e4})}catch{return{installed:!1,authed:!1,detail:"not connected \u2014 needs the GitHub CLI"}}try{let{stdout:t,stderr:e}=await qn("gh auth status",{timeout:1e4});return Vn(t,e,0)}catch(t){return Vn(t.stdout??"",t.stderr ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

4`)}async function Xn(t){let e=st[t];if(!e)return`Unknown connector "${t}". Available: ${Object.keys(st).join(", ")}.`;let n=await e.check();return n.authed?`${e.name}: ${n.detail}. You're all set

5`):[`${e.name}: the GitHub CLI isn't installed yet.`,"","To connect GitHub:"," 1. Quit Brett (type /quit)"," 2. Install: winget install GitHub.cli"," 3. Run: gh auth login"," 4. Start Brett again","","GitHub is optional \u2014 everything else works without it."].join(`

6`)}var qn,st,ee=Vt(()=>{"use strict";qn=Go(zo);st={github:{id:"github",name:"GitHub",check:qo,setupHint:`Brett uses the GitHub CLI for branches, commits, and pull requests.

7 1. winget install GitHub.cli

8 2. gh auth login

9Once signed in, ask Brett to commit changes or open a PR.`}}});var Me={};en(Me,{runConnect:()=>xs});import{spawnSync as bs}from"child_process";async function xs(t){if(!t){for(let o of Object.values(st)){let s=await o.check(),a=s.authed?"\u2713

10Usage: brett connect <name> (e.g. brett connect github)

12For GitHub, just run: gh auth login`);return}let e=t.toLowerCase(),n=st[e];if(!n){console.log(`Unknown connector: ${t}`),console.log(`Available: ${Object.keys(st).join(", ")}`);return}let r=await n.check();if(r.authed){console.log(`${

13`),console.log(" Install: winget install GitHub.cli"),console.log(" Then run: gh auth login");return}console.log(`Signing in to GitHub...

14`),bs("gh",["auth","login"],{stdio:"inherit"}).status===0?console.log(`

15GitHub connected! Start brett and it can create branches, commits, and PRs.`):console.log(`

16Sign-in was not completed. Try again: gh auth login`);return}console.log(`${n.name} setup:

18${n.setupHint}`)}var Ne=Vt(()=>{"use strict";ee()});var hr={};en(hr,{runLogin:()=>ws});import*as pr from"readline";async function ws(){let t=pr.createInterface({input:process.stdin,output:process.stdout}),e=o=>new

19`);let n=await e("Email: "),r=await e("Password: ");t.close();try{let o=await wn(n.trim(),r);console.log(`

20Logged in as ${o.email}. Token stored in ~/.brett/auth.json`)}catch(o){console.error(`

21${o instanceof Error?o.message:"Login failed"}`),process.exitCode=1}}var gr=Vt(()=>{"use strict";Ot()});import"dotenv/config";import{render as ks}from"ink";import{createInterface as Ts}from"readline";import*as ur from"dotenv";

22`),n=[],r=0,o=0,s=!1,a=[],c=[],f=()=>{let u=Math.max(a.length,c.length);for(let m=0;m<u;m++){let y=a[m],k=c[m];n.push({leftNo:y?String(y.no):"",leftContent:y?y.content:"",leftType:y?"removed":"empty",rightNo:k?String(k.no):"",rightContent:k?k.content:"",rightType:k?"added":"empty"})}a=[],c=[]};for(let u of e){if(u.startsWith("diff ")||u.startsWith("index ")){f(),n.push({leftNo:"",leftContent:u,leftType:"header",rightNo:"",rightContent:"",rightType:"empty"});continue}if(u.startsWith("---")){f(),n.push({leftNo:"",leftContent:u,leftType:"header",rightNo:"",rightContent:"",rightType:"empty"});cont ...

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

dist/index.jsView file

2patternName = supabase_service_key severity = critical line = 2 matchedText = var Er=O...${t}

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

2patternName = supabase_service_key severity = critical line = 2 matchedText = var Er=O...${t}

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L2

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: var Er=Object.defineProperty;var Vt=(t,e)=>()=>(t&&(e=t(t=0)),e);var en=(t,e)=>{for(var n in e)Er(t,n,{get:e[n],enumerable:!0})};import{readFileSync as qr,writeFileSync as Vr,mkdir... L3: ${e}`,o=r.match(/Logged in to [\w.]+ account (\S+)/i)||r.match(/Logged in to [\w.]+ as (\S+)/i);return n===0&&o?{installed:!0,authed:!0,account:o[1],detail:`Connected as ${o[1]}`}:... L4: `)}async function Xn(t){let e=st[t];if(!e)return`Unknown connector "${t}". Available: ${Object.keys(st).join(", ")}.`;let n=await e.check();return n.authed?`${e.name}: ${n.detail}....

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

2 Critical3 High2 Medium4 Low

CriticalCritical Secretdist/index.js

CriticalSecret Patterndist/index.js

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L2

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L2

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

4`)}async function Xn(t){let e=st[t];if(!e)return`Unknown connector "${t}". Available: ${Object.keys(st).join(", ")}.`;let n=await e.check();return n.authed?`${e.name}: ${n.detail}. You're all set

6`)}var qn,st,ee=Vt(()=>{"use strict";qn=Go(zo);st={github:{id:"github",name:"GitHub",check:qo,setupHint:`Brett uses the GitHub CLI for branches, commits, and pull requests.

7 1. winget install GitHub.cli

8 2. gh auth login

10Usage: brett connect <name> (e.g. brett connect github)

13`),console.log(" Install: winget install GitHub.cli"),console.log(" Then run: gh auth login");return}console.log(`Signing in to GitHub...

14`),bs("gh",["auth","login"],{stdio:"inherit"}).status===0?console.log(`

15GitHub connected! Start brett and it can create branches, commits, and PRs.`):console.log(`

16Sign-in was not completed. Try again: gh auth login`);return}console.log(`${n.name} setup:

19`);let n=await e("Email: "),r=await e("Password: ");t.close();try{let o=await wn(n.trim(),r);console.log(`

20Logged in as ${o.email}. Token stored in ~/.brett/auth.json`)}catch(o){console.error(`

Long lines were clipped for display.