registry / code-i18n-agent / 0.1.5
code-i18n-agent@0.1.5
智能体：自动将代码项目国际化的扫描-分类-提取-翻译-替换-验证管线（不限于 ERP，适配 Vue/React/TS/JS/HTML）
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source uses credentials only for the configured OpenAI-compatible LLM service and sends feature-related prompt data there. The MCP subprocess and project writes are tied to requested tool operations; no install-time data collection or unrelated attack behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
LLM requests occur during CLI or MCP operations; MCP starts project actions only after a tool call.
Impact
Project text may be sent to the configured LLM service, and requested MCP runs may modify project files.
Mechanism
Uses an OpenAI-compatible chat completions endpoint with the configured API key and sends the prompt content needed for translation or classification.
AI rationale
The source uses credentials only for the configured OpenAI-compatible LLM service and sends feature-related prompt data there. The MCP subprocess and project writes are tied to requested tool operations; no install-time data collection or unrelated attack behavior was identified.
Evidence
<project> source files and locale resources during requested write operations
Network endpoints2
api.openai.com/v1/chat/completionsconfigured OpenAI-compatible baseURL + /chat/completions
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall hook; prepublishOnly builds and runs tests.
- LLM credentials come from OpenAI-specific environment variables, with the base URL configurable for that service.
- The LLM client sends prompts and the configured API key to the configured OpenAI-compatible chat completions endpoint.
- The MCP server launches its own CLI with Node and maps requested tools to fixed CLI commands.
Evidence against
- The MCP i18n_run tool can write project files when explicitly called without dry_run.
- The CLI entrypoint starts its command handler when invoked.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/mcp-server.jsView file
54const readline = __importStar(require("readline"));
L55: const cp = __importStar(require("child_process"));
L56: const path = __importStar(require("path"));
High
Child Process
Package source references child process execution.
dist/mcp-server.jsView on unpkg · L5454Cross-file remote execution chain: dist/mcp-server.js spawns dist/config.js; helper contains network access plus dynamic code execution.
L54: const readline = __importStar(require("readline"));
L55: const cp = __importStar(require("child_process"));
L56: const path = __importStar(require("path"));
...
L171: // 每行一个 JSON，行尾必须有 \n（MCP stdio 帧分隔）
L172: process.stdout.write(JSON.stringify(msg) + '\n');
L173: }
...
L191: return new Promise((resolve) => {
L192: const cliPath = path.join(__dirname, 'cli.js');
L193: const child = cp.spawn(process.execPath, [cliPath, ...args], {
L194: cwd: process.cwd(),
L195: env: process.env,
L196: windowsHide: true
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/mcp-server.jsView on unpkg · L54package.jsonView file
Findings
1 Critical3 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/config.js
HighChild Processdist/mcp-server.js
HighCross File Remote Execution Contextdist/mcp-server.js
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to code-i18n-agent@0.1.5.
See all versions of code-i18n-agent for other recorded verdicts.
- Review the evidence and your use of code-i18n-agent@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.