flavor-code@1.4.1

<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has broad but package-aligned interactive coding capabilities and no registry install lifecycle hook. The only confirmed reporting path is opt-in and defaults to localhost, so the scanner's claimed credential redirection and automatic exfiltration are not supported by inspected source.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user enables incident reporting and a tool failure occurs.

Impact

Configured recipients could receive workspace metadata and the failed tool input.

Mechanism

Optional webhook reporting of tool failure context.

AI rationale

Evidence

package.jsondist/chunk-O2PC44GY.jsdist/desktop/main.js

Network endpoints1

localhost:8000

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The desktop runtime includes an opt-in incident reporter that can send failed tool input and workspace metadata to a configured webhook.
The application exposes user-invoked terminal capabilities, so command execution is a real runtime capability.
The command helper runs a specified executable with supplied arguments, timeout, working-directory, and environment options.
The CLI configures Node crash diagnostics to write reports and heap snapshots next to the working directory.

Evidence against

package.json has no preinstall, install, or postinstall hook.
No fixed unofficial credential gateway or command-output exfiltration endpoint was found in the inspected high-risk files.
The reporter is disabled unless explicitly enabled; its default endpoint is localhost.
The command and network features are part of an interactive coding application and include permission controls.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Source & flagged code

11 flagged

dist/chunk-ZJCAQXA7.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { createRequire } from "node:module"; const require = createRequire(import.meta.url);

4// src/utils/execFileNoThrow.ts

5import { execFile } from "child_process";

6function execFileNoThrow(file, args, options = {}) {

High

Child Process

Package source references child process execution.

dist/chunk-ZJCAQXA7.jsView on unpkg · L4

7 return new Promise((resolve2) => {

8 const child = execFile(file, args, {

9 timeout: options.timeout,

10 cwd: options.useCwd === false ? void 0 : process.cwd(),

11 env: options.env,

12 encoding: "utf8",

13 windowsHide: true,

14 ...options.signal === void 0 ? {} : { signal: options.signal }

15 }, (error, stdout, stderr) => {

16 resolve2({

17 stdout,

18 stderr,

19 code: typeof error?.code === "number" ? error.code : error ? 1 : 0,

20 ...error === null ? {} : { error: error.message }

21 });

22 });

23 if (options.input !== void 0) child.stdin?.end(options.input);

24 });

dist/desktop/main.jsView file

7657} L7658: if (["powershell", "pwsh"].includes(name)) { L7659: const flag = args.findIndex((arg) => ["-command", "-c"].includes(arg.toLowerCase()));

High

Shell

Package source references shell execution.

dist/desktop/main.jsView on unpkg · L7657

9213function runShellHandler(descriptor, event, signal) { L9214: return new Promise((resolve44, reject) => { L9215: const env = { ...process.env, ...descriptor.env }; L9216: const invocation = prepareSpawnInvocation(descriptor.command, descriptor.args ?? [], { env }); L9217: const child = spawn(invocation.command, invocation.args, { L9218: env,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/desktop/main.jsView on unpkg · L9213

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/desktop/main.js: import { readFile as readFile41, stat as stat20, writeFile as writeFile19 } from "fs/promises"; baseURL: z.string().trim().url().max(2048).refine((value) => { baseURL: z2.string().url().optional(), authorizationUrl: z2.string().url().optional(), await handle.writeFile(data2); baseURL: HttpUrlInput, async function runInteractionManifest(manifest, baseUrl, createDriver) { if (!isLoopbackPreviewUrl(baseUrl)) throw new Error("D2C interaction preview must use a loopback HTTP URL");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/desktop/preload.cjsView file

Lines 1-23javascript

1"use strict";

3// src/desktop/preload.ts

4var import_electron = require("electron");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/desktop/preload.cjsView on unpkg · L3

6// src/desktop/channels.ts

7var

dist/desktop/plugin-worker-entry.jsView file

Lines 8-48javascript

8var CONTRIBUTION_NAME_SOURCE = "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$";

9var data = workerData;

10var port = parentPort;

11if (port === null) throw

dist/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2import { createRequire } from "node:module"; const require = createRequire(import.meta.url);

3import {

4 MEMORY_RESTART_EXIT_CODE,

5 memoryRestartArgs,

dist/chunk-O2PC44GY.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = flavor-code@1.3.19 matchedIdentity = npm:Zmxhdm9yLWNvZGU:1.3.19 similarity = 0.435 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-O2PC44GY.jsView on unpkg

Source & flagged code

11 flagged · loading source

dist/chunk-ZJCAQXA7.jsView file

4// src/utils/execFileNoThrow.ts L5: import { execFile } from "child_process"; L6: function execFileNoThrow(file, args, options = {}) {

High

Child Process

Package source references child process execution.

dist/chunk-ZJCAQXA7.jsView on unpkg · L4

dist/desktop/main.jsView file

7657} L7658: if (["powershell", "pwsh"].includes(name)) { L7659: const flag = args.findIndex((arg) => ["-command", "-c"].includes(arg.toLowerCase()));

High

Shell

Package source references shell execution.

dist/desktop/main.jsView on unpkg · L7657

High

Findings

1 Critical7 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/chunk-O2PC44GY.js

HighChild Processdist/chunk-ZJCAQXA7.js

HighShelldist/desktop/main.js

HighSame File Env Network Executiondist/desktop/main.js

HighCredential Redirect Persistencedist/desktop/main.js

HighCommand Output Exfiltrationdist/desktop/main.js

HighCross File Remote Execution Contextdist/cli.js

HighTrigger Reachable Command Output Exfiltrationdist/desktop/main.js

MediumDynamic Requiredist/desktop/preload.cjs

MediumUnsafe Vm Contextdist/desktop/plugin-worker-entry.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to flavor-code@1.4.1.

See all versions of flavor-code for other recorded verdicts.

Review the evidence and your use of flavor-code@1.4.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-12 00:32:51.855Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.