dokugen@14.2.0
Readme generator command line tool.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe flagged install hook only conditionally loads a helper that changes a local file permission. Runtime network activity is part of user-invoked package functions, and the inspected generation request sends project code but not the stored GitHub token.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs a Dokugen command; the postinstall hook separately runs during installation.
Impact
No confirmed malicious impact. Project code is transmitted as part of the requested README-generation service.
Mechanism
The postinstall helper changes a local file's executable permission. Runtime code checks for updates when a command is invoked, and README generation posts compressed project code to the selected backend.
AI rationale
The flagged install hook only conditionally loads a helper that changes a local file permission. Runtime network activity is part of user-invoked package functions, and the inspected generation request sends project code but not the stored GitHub token.
Evidence
package.jsondist/bin/commands/changelog.mjsdist/bin/helpers/network.mjsdist/bin/helpers/readme.mjsdist/bin/helpers/auth.mjs
Network endpoints4
registry.npmjs.org/dokugen/latestlocalhost:${port}/api/healthdokugen.samueltuoyo.com/api/get-server-url${backendDomain}/api/generate-readme
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs postinstall, which conditionally loads a chmod helper; the helper only changes a local file permission.
- The flagged changelog command invokes its network check only after the user selects or runs the command.
- The update helper checks the npm registry and installs only a newer dokugen release, globally, with lifecycle scripts disabled.
- README generation compresses project code and sends it to the selected backend as part of its generation request.
- Backend selection uses configured domains, then local health checks, then the dokugen service; the inspected code does not forward the GitHub token in the generation request.
Evidence against
- No inspected source establishes covert install-time execution, credential theft, destructive behavior, or an unconsented consumer-project policy change.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "import('fs').then(fs => { if (fs.existsSync('dist/scripts/postinstall.mjs')) import('./dist/scripts/postinstall.mjs'); }).catch(() => {})"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "import('fs').then(fs => { if (fs.existsSync('dist/scripts/postinstall.mjs')) import('./dist/scripts/postinstall.mjs'); }).catch(() => {})"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/bin/commands/changelog.mjsView file
1import { execFileSync, execSync } from "node:child_process";
L2: import path from "node:path";
High
Child Process
Package source references child process execution.
dist/bin/commands/changelog.mjsFindings
2 Critical5 High3 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/bin/helpers/network.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/bin/commands/changelog.mjs
HighShell
HighSame File Env Network Executiondist/bin/helpers/readme.mjs
HighRuntime Package Installdist/bin/helpers/network.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/bin/helpers/fileOps.mjs
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dokugen@14.2.0.
See all versions of dokugen for other recorded verdicts.
- Review the evidence and your use of dokugen@14.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.