registry / buildpartner / 0.15.0
buildpartner@0.15.0
Your AI build partner. Expert guidance inside Claude Code.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected code uses the saved BuildPartner token for requests to the service’s default or user-configured API base. BuildPad uploads only a path supplied to its tool and filters hidden paths and credential-like files; the package declares no install lifecycle hook.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User invokes the CLI or asks an MCP tool to perform an action.
Impact
Expected service use: requested data is sent to BuildPartner; no unrelated credential collection or automatic install-time behavior was identified.
Mechanism
API requests use the saved BuildPartner token with the default BuildPartner host or a configured API base. BuildPad uploads the path provided for a create or update action.
AI rationale
The inspected code uses the saved BuildPartner token for requests to the service’s default or user-configured API base. BuildPad uploads only a path supplied to its tool and filters hidden paths and credential-like files; the package declares no install lifecycle hook.
Evidence
User-supplied BuildPad HTML file or folder~/.buildpartner/pads/<id>.json~/.buildpartner/auth.json
Network endpoints3
www.buildpartner.ai${API_BASE}/api/buildpartner/pads${API_BASE} (API base can be configured with BP_API_BASE or saved api_base)
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a CLI; its scripts are build and dev, with no install lifecycle hook.
- The API client defaults to BuildPartner’s HTTPS host and sends its saved token as a bearer credential to the configured API base.
- BuildPad uploads a path supplied to its explicit create action to the BuildPartner pads API.
- Folder uploads skip hidden paths and exclude credential-like filenames and files with .env, .pem, or .key extensions.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
4 flaggeddist/src/mcp/build-pad.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = buildpartner@0.12.7
matchedIdentity = npm:YnVpbGRwYXJ0bmVy:0.12.7
similarity = 0.429
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/mcp/build-pad.jsView on unpkgpackage.jsonView file
16"scripts": {
"build": "tsc",
"dev": "tsx bin/cli.ts"
},
"dependencies": {
"@modelcontextprotocol/sdk": "latest",
"chalk": "^5",
"uuid": "^11"
},
"devD
Low
Suspicious Lifecycle Evidence
The package exposes a CLI; its scripts are build and dev, with no install lifecycle hook.
package.jsonView on unpkg · L16dist/src/api-client.jsView file
Findings
1 High3 Medium8 Low
HighPrevious Version Dangerous Deltadist/src/mcp/build-pad.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/src/api-client.js
LowAi Review Evidencedist/src/api-client.js
Affected versions and remediation
This report applies to buildpartner@0.15.0.
See all versions of buildpartner for other recorded verdicts.
- Review the evidence and your use of buildpartner@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.