create-pmos@0.502.0
Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe workspace starts model runs automatically when it detects qualifying metric gaps, using the user’s own login without a per-run request. Because this can consume the user’s model quota by default, the package meets the rule for malicious automatic use of a user’s resources.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The PMOS Workspace server runs its periodic background tick while a qualifying workspace is available.
Impact
These jobs can consume the user’s model quota and access configured connector sources without a per-run request.
Mechanism
The tick scans workspace data for metric gaps and starts due jobs without a user press; opt-out requires an explicit environment setting.
Attack narrative
When the PMOS Workspace is running, its periodic server tick calls the metric-draft scanner. Unless explicitly disabled, the scanner starts qualifying jobs with no user press and spawns Claude Code headlessly. The package describes these runs as unasked and says headless runs use the user’s own login and cannot request permission. This can consume the user’s model quota and access configured connector sources without a per-run request.
AI rationale
The workspace starts model runs automatically when it detects qualifying metric gaps, using the user’s own login without a per-run request. Because this can consume the user’s model quota by default, the package meets the rule for malicious automatic use of a user’s resources.
Evidence
workspace/lib/metric-draft-runs.jsworkspace/server.jsworkspace/lib/headless.js
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The metric-draft module describes runs that start “with no press” when workspace metrics or goals are missing.
- The workspace server’s periodic background loop calls metricDraftTick().
- The metric-draft tick scans workspaces and starts jobs for due scopes; its default behavior is disabled only by explicit off settings.
- An unpressed run is spawned headlessly with a prompt, using the user’s own login and model; headless runs cannot ask permission.
Evidence against
- The automatic drafts are limited to the PMOS metrics feature, and the package says only the user’s keep action writes a metric record.
- The feature can be disabled with PMOS_METRIC_DRAFT=off or PMOS_HEADLESS=off.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
13 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const { spawnSync } = require('child_process');
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23181const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L182: try { return spawnSync(probe, { stdio: 'ignore', shell: true }).status === 0; }
L183: catch { return false; }
High
Shell
Package source references shell execution.
bin/create-pmos.jsFindings
1 Critical7 High7 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighEvalworkspace/public/vendor/pdf.worker.min.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1
MediumSecret Patternworkspace/premium-viewer-share-test.js
MediumDynamic Requirebin/create-pmos.js
MediumNetwork
Affected versions and remediation
This report applies to create-pmos@0.502.0.
See all versions of create-pmos for other recorded verdicts.
- Avoid installing create-pmos@0.502.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.