registry / buildpartner / 0.15.3
buildpartner@0.15.3
Your AI build partner. Expert guidance inside Claude Code.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package has no install-time hooks, and its CLI runs selected commands only when invoked. Credential use is directed to the configured BuildPartner API, while BuildPad publication is user-triggered and excludes neighboring data files by default.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI command or invokes an MCP tool; there are no install hooks.
Impact
Expected service use; no automatic unrelated collection or destructive behavior was identified.
Mechanism
The API client sends its saved BuildPartner token to the configured API base. BuildPad publishes a user-specified page, with neighboring data files excluded unless include_data is requested.
AI rationale
The package has no install-time hooks, and its CLI runs selected commands only when invoked. Credential use is directed to the configured BuildPartner API, while BuildPad publication is user-triggered and excludes neighboring data files by default.
Evidence
~/.buildpartner/auth.json~/.buildpartner/pads/<id>.json
Network endpoints3
www.buildpartner.ai${BP_API_BASE}auth.api_base
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install or lifecycle hooks; its scripts are build and dev commands.
- The CLI dispatches only when a command is supplied, to serve, doctor, or login.
- API requests use the saved token with the configured BuildPartner API base; the base comes from BP_API_BASE, saved auth configuration, or the BuildPartner production URL.
- BuildPad exposes publishing through an MCP tool call, and says data files stay local unless include_data is passed.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
4 flaggeddist/src/mcp/build-pad.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = buildpartner@0.15.2
matchedIdentity = npm:YnVpbGRwYXJ0bmVy:0.15.2
similarity = 0.429
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/src/mcp/build-pad.jsView on unpkgpackage.jsonView file
1{
"name": "buildpartner",
"version": "0.15.3",
"type": "module",
"description": "Your AI build partner. Expert guidance inside Claude Code.",
"bin": {
"buildpartner": "dist/bin/cli.js"
},
"exports": {
".": "./dist/bin/cli.js",
"./constants": "./dist/src/constants.js"
},
"files": [
"dist"
],
"scripts": {
"build": "tsc",
"dev": "tsx bin/cli.ts"
},
"dependencies": {
"@modelcontextprotocol/sdk": "latest",
"chalk": "^5",
"uuid": "^11"
},
"devDependencies": {
"@types/node": "^22",
"@types/uuid": "^10",
Low
Suspicious Lifecycle Evidence
The manifest has no install or lifecycle hooks; its scripts are build and dev commands.
package.jsonView on unpkg · L1Findings
1 High3 Medium8 Low
HighPrevious Version Dangerous Deltadist/src/mcp/build-pad.js
MediumNetwork
MediumEnvironment Vars
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/bin/cli.js
LowAi Review Evidencedist/src/api-client.js
Affected versions and remediation
This report applies to buildpartner@0.15.3.
See all versions of buildpartner for other recorded verdicts.
- Review the evidence and your use of buildpartner@0.15.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.