registry / create-pmos / 0.530.0

create-pmos@0.530.0

Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The manifest has no lifecycle scripts, and the CLI’s filesystem and agent-configuration changes occur when the user invokes its scaffolding command. The flagged routing code sends prompts only to a PMOS workspace loopback endpoint, with no evidence of credential theft or unrelated outbound collection.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Explicit CLI invocation; routing occurs from the bundled cockpit mod when its session hook handles prompts.

Impact

No malicious impact identified.

Mechanism

The mod sends routing requests to the PMOS workspace over its loopback endpoint. No credential exfiltration or unrelated external collector was found in the reviewed paths.

AI rationale

Evidence

.claude/settings.json.claude/skills/*

Network endpoints1

127.0.0.1:<port>/api/model/route

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The executable performs scaffolding only when invoked as the CLI.
The cockpit settings entry offers a bundled mod from ./pmos/mods.
Prompt routing sends requests to a PMOS workspace loopback endpoint; the mod does not receive the Jev key.
Routing accepts only a loopback URL, and sub-agent prompts are routed only when routing is enabled and no model was specified.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 971 file(s), 17.2 MB of source, external domains: 127.0.0.1, acme.atlassian.net, acme.slack.com, app.amplitude.com, auth0.com, boards.example.com, boards.pm-os.app, boards.test, claude.ai, docs.google.com, docs.npmjs.com, docs.stripe.com, drive.example, evil.example, example.atlassian.net, example.com, fonts.googleapis.com, fonts.gstatic.com, foo.bar, github.com, github.com.helper, huggingface.co, jira.example, jira.example.com, mail.example, mcp.atlassian.com, mcp.slack.com, meet.google.com, ns.adobe.com, pm-os.app, pmos-menus.test, purl.org, regulator.example, rivalnotes.example, schemas.openxmlformats.org, share.example, share.invalid, slack.example, slack.example.com, upgrade.invalid, wiki.example, wiki.example.com, www.apple.com, www.w3.org, www.xfa.org, x.atlassian.net, x.example

Source & flagged code

25 flagged

workspace/premium-viewer-share-test.jsView file

61patternName = generic_password severity = medium line = 61

Medium

Secret Pattern

Package contains a possible secret pattern.

workspace/premium-viewer-share-test.jsView on unpkg · L61

bin/create-pmos.jsView file

23const path = require('path'); L24: const cp = require('child_process'); // cp.spawnSync, so a test can stand in for it L25:

High

Child Process

Package source references child process execution.

bin/create-pmos.jsView on unpkg · L23

186const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`; L187: try { return cp.spawnSync(probe, { stdio: 'ignore', shell: true, ...hide() }).status === 0; } L188: catch { return false; }

High

Shell

Findings

1 Critical19 High7 Medium5 Low

CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx

HighChild Processbin/create-pmos.js

HighShellbin/create-pmos.js

HighEvalworkspace/public/vendor/pdf.worker.min.js

HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js

HighCommand Output Exfiltrationworkspace/server.js

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js

HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1

HighKnown Malware Source Similarityworkspace/doctor.js

HighKnown Malware Source Similarityworkspace/adler-seasons-art-test.js

High

Affected versions and remediation

This report applies to create-pmos@0.530.0.

See all versions of create-pmos for other recorded verdicts.

Review the evidence and your use of create-pmos@0.530.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 15:26:25.303Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / create-pmos / 0.530.0

create-pmos@0.530.0

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Explicit CLI invocation; routing occurs from the bundled cockpit mod when its session hook handles prompts.

Impact

No malicious impact identified.

Mechanism

The mod sends routing requests to the PMOS workspace over its loopback endpoint. No credential exfiltration or unrelated external collector was found in the reviewed paths.

AI rationale

Evidence

.claude/settings.json.claude/skills/*

Network endpoints1

127.0.0.1:<port>/api/model/route

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The executable performs scaffolding only when invoked as the CLI.
The cockpit settings entry offers a bundled mod from ./pmos/mods.
Prompt routing sends requests to a PMOS workspace loopback endpoint; the mod does not receive the Jev key.
Routing accepts only a loopback URL, and sub-agent prompts are routed only when routing is enabled and no model was specified.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

25 flagged

workspace/premium-viewer-share-test.jsView file

61patternName = generic_password severity = medium line = 61

Medium

Secret Pattern

Package contains a possible secret pattern.

workspace/premium-viewer-share-test.jsView on unpkg · L61

bin/create-pmos.jsView file

23const path = require('path'); L24: const cp = require('child_process'); // cp.spawnSync, so a test can stand in for it L25:

High

Child Process

Package source references child process execution.

bin/create-pmos.jsView on unpkg · L23

High

Shell

Findings

1 Critical19 High7 Medium5 Low

CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx

HighChild Processbin/create-pmos.js

HighShellbin/create-pmos.js

HighEvalworkspace/public/vendor/pdf.worker.min.js

HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js

HighCommand Output Exfiltrationworkspace/server.js

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js

HighSemantic Analysis Limitedbin/create-pmos.js#virtual:normalized:round1

HighKnown Malware Source Similarityworkspace/doctor.js

HighKnown Malware Source Similarityworkspace/adler-seasons-art-test.js

High

Affected versions and remediation

This report applies to create-pmos@0.530.0.

See all versions of create-pmos for other recorded verdicts.

Review the evidence and your use of create-pmos@0.530.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-11-04 15:26:25.303Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.