registry / create-pmos / 0.489.0
create-pmos@0.489.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest has no lifecycle hook, and the suspicious-looking process, network, and credential paths serve the package's installer and workspace features. Prompt transmission to the external classifier is gated by saved credentials, repository consent, and an off-by-default routing setting.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the create-pmos CLI; workspace prompt routing additionally requires the configured route and consent gates.
Impact
Expected project setup and consented prompt classification; no malicious impact identified.
Mechanism
The CLI scaffolds the kit and workspace. The cockpit hook sends eligible prompts to a loopback route; the workspace forwards them to its fixed classifier service only when its key, repository-consent, and route gates are open.
AI rationale
The manifest has no lifecycle hook, and the suspicious-looking process, network, and credential paths serve the package's installer and workspace features. Prompt transmission to the external classifier is gated by saved credentials, repository consent, and an off-by-default routing setting.
Network endpoints2
127.0.0.1:<port>/api/model/routeapi.typesafe.ai/v1/systemone
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI binary; no automatic lifecycle entry point is declared.
- The scaffold adds the cockpit mod through repository settings when the user runs the CLI; the source says Claude Code asks the user to trust the project.
- The cockpit hook accepts only a PMOS workspace route on 127.0.0.1 and sends eligible prompts there.
- Forwarding prompts from the workspace to Jev requires a saved key, per-repository consent, and the route switch, which is off by default; secret-scanned and excluded prompts are withheld.
- The TypeSafe request uses the fixed api.typesafe.ai endpoint and sends the service key in a request header.
- The Anthropic API integration uses the user's Anthropic key for the workspace's own grill runs, and limits its tools to repository reads and a restricted PMOS command.
Evidence against
- The package contains shell commands and workspace code that use network and process APIs, consistent with its installer and local GUI purpose.
- Scanner-reported credential flows resolve to the GitHub release API using GITHUB_TOKEN or to the package's intended AI-service integrations; no unrelated credential destination was identified.
Source & flagged code
14 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
2 Critical7 High7 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
CriticalPrevious Version Dangerous Deltaworkspace/lib/headless.js
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighEvalworkspace/public/vendor/pdf.worker.min.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
Medium
Affected versions and remediation
This report applies to create-pmos@0.489.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.489.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.