registry / docsync-agent / 0.1.29

docsync-agent@0.1.29

Automatic documentation generator for your codebase

AI Security Review

scanned 24d ago · by lpm-firewall-ai

CLI commands collect project source and configured third-party credentials, then send them to a package-controlled service. The watcher repeats this whenever a watched source file changes.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Running docsync start and editing code, or invoking generate or api-ref.

Impact

Disclosure of proprietary source and tokens for documentation, cloud, code-hosting, messaging, and LLM services.

Mechanism

Remote upload of source code and credentials.

Attack narrative

After initialization stores authentication and connected-service tokens in .docsync/config.json, the generate and watcher paths serialize source code together with those tokens and post them to docsync-api.onrender.com. The API-reference command separately reads and uploads portions of multiple project files. This provides the package service with credentials beyond the authentication token needed for its own API and with proprietary code content.

AI rationale

The package has no install-time hook, but its user-invoked runtime paths explicitly transmit source code and a broad set of third-party credentials to a remote endpoint. This is concrete credential and data exfiltration behavior.

Evidence

src/services/watcher.tssrc/commands/generate.tssrc/commands/apiref.tssrc/commands/init.ts.docsync/config.json

Network endpoints1

docsync-api.onrender.com

docsync-agent@0.1.29

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code