registry / create-pmos / 0.531.0
create-pmos@0.531.0
⚠ Under reviewScaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with a
Static Scan Results
scanned 4h ago · by rust-scannerStatic analysis completed at 97.0% confidence. No malicious behavior was detected; 32 low-signal pattern(s) were surfaced and cleared.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
25 flaggedworkspace/premium-viewer-share-test.jsView file
61patternName = generic_password
severity = medium
line = 61
Medium
Secret Pattern
Package contains a possible secret pattern.
workspace/premium-viewer-share-test.jsView on unpkg · L61bin/create-pmos.jsView file
23const path = require('path');
L24: const cp = require('child_process'); // cp.spawnSync, so a test can stand in for it
L25:
High
Child Process
Package source references child process execution.
bin/create-pmos.jsView on unpkg · L23186const probe = process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`;
L187: try { return cp.spawnSync(probe, { stdio: 'ignore', shell: true, ...hide() }).status === 0; }
L188: catch { return false; }
High
Shell
Findings
1 Critical19 High7 Medium5 Low
CriticalCredential Exfiltrationpayload/mods/pmos-cockpit/hooks/register.tsx
HighChild Processbin/create-pmos.js
HighShellbin/create-pmos.js
HighEvalworkspace/public/vendor/pdf.worker.min.js
HighSame File Env Network Executionworkspace/premium-chat-chart-tab-test.js
HighCommand Output Exfiltrationworkspace/server.js
HighTrigger Reachable External Ai Agent Control Surface Mutationbin/create-pmos.js
HighSemantic Analysis Limitedpayload/scripts/okf-upgrade.js#virtual:string-array:round1
HighKnown Malware Source Similarityworkspace/doctor.js
HighKnown Malware Source Similarityworkspace/adler-seasons-art-test.js
Affected versions and remediation
This report applies to create-pmos@0.531.0.
See all versions of create-pmos for other recorded verdicts.
- Review the evidence and your use of create-pmos@0.531.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.