dokugen@14.0.1
Readme generator command line tool.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe sensitive data transfers and Git/file mutations are direct, documented consequences of user-invoked README and AI-commit features. The lifecycle hook only attempts a failed package-relative chmod and contains no malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `dokugen generate`, `update`, or `aic`
Impact
Project code, Git identity, repository URL, or staged diff may be disclosed to the configured service by the selected feature.
Mechanism
User-invoked source/diff upload and README/Git operations
AI rationale
The sensitive data transfers and Git/file mutations are direct, documented consequences of user-invoked README and AI-commit features. The lifecycle hook only attempts a failed package-relative chmod and contains no malicious chain.
Evidence
package.jsondist/scripts/postinstall.mjsdist/bin/commands/generate.mjsdist/bin/commands/aic.mjsdist/bin/helpers/readme.mjsdist/bin/helpers/network.mjsdist/bin/helpers/git.mjsdist/bin/helpers/fileOps.mjsREADME.md
Network endpoints5
dokugen-readme.vercel.app/api/get-server-urlregistry.npmjs.org/dokugen/latestwww.google.comlocalhost:3000/api/healthapi.myhappr.com/api/v1/auth/google-auth
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `generate` uploads compressed project source, Git identity, and repo URL to its backend.
- `aic` uploads the staged Git diff for commit-message generation.
- `postinstall` attempts a chmod on `./bin/dokugen.ts`, but that file is absent from the package.
Evidence against
- All uploads occur only in explicit CLI commands documented in `README.md`.
- No install-time network, payload download, credential harvesting, or agent-config mutation found.
- Shell use is limited to declared Git operations, browser opening after a prompt, and self-update with `--ignore-scripts`.
- No eval/vm/native binary loading or hidden persistence found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node dist/scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: fs
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg•scripts.postinstall = node dist/scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/bin/commands/aic.mjsView file
Findings
6 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/bin/commands/aic.mjs
HighShell
HighSame File Env Network Executiondist/bin/helpers/readme.mjs
HighRuntime Package Installdist/bin/helpers/network.mjs
HighNode Builtin Dependency Squatpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/bin/helpers/fileOps.mjs
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to dokugen@14.0.1.
See all versions of dokugen for other recorded verdicts.
- Review the evidence and your use of dokugen@14.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.