flavor-code@1.4.3

<p align="center"><a href="./README.md">English</a> | <b><a href="./README.zh-CN.md">简体中文</a></b></p>

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected source supports ordinary provider authentication and user-invoked project setup; the scanner signals do not establish an attack. The required agent-integration locations contain workspace instruction-file names, not evidence of hostile configuration writes.

Static reason

One or more suspicious static signals were detected.

Trigger

Using the desktop app or explicitly running the CLI setup command.

Impact

No confirmed credential exfiltration, unconsented install-time mutation, or other attack surface was established.

Mechanism

The desktop app loads configured provider credentials; the CLI invokes project initialization for its selected working directory. The named instruction-file locations are workspace instruction discovery.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 79.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json points to desktop and CLI entrypoints; the inspected scripts section contains build tasks, with no install hook shown.
The CLI calls project initialization from a directory selected by the user.
The named chunk locations enumerate workspace instruction files such as AGENTS.md and CLAUDE.md.
The desktop runtime reads OPENAI_API_KEY and ANTHROPIC_API_KEY as provider credentials; the inspected code shows no unrelated recipient.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 61 file(s), 7.06 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.example.com, api.openai.com, auth.openai.com, docs.anthropic.com, docs.expo.dev, example.com, github.com, help.openai.com, json-schema.org, lite.duckduckgo.com, mcp.example.com, platform.claude.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, www.bing.com, www.w3.org

Source & flagged code

11 flagged

dist/cli-main.jsView file

201import { EventEmitter } from "events"; L202: import childProcess from "child_process"; L203: import path from "path";

High

Child Process

Package source references child process execution.

dist/cli-main.jsView on unpkg · L201

dist/chunk-QACFKPZP.jsView file

1#!/usr/bin/env node L2: import { createRequire as createFlavorRequire } from "node:module"; const require = createFlavorRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QACFKPZP.jsView on unpkg · L1

3086sourceCode = this.opts.code.process(sourceCode, sch); L3087: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L3088: const validate2 = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-QACFKPZP.jsView on unpkg · L3086

1370// validation function arguments L1371: data: new codegen_1.Name("data"), L1372: // data passed to validation function ... L2397: id = normalizeId(id); L2398: return resolver.resolve(baseId, id); L2399: } ... L3278: for (i = 0; i < input.length; i++) { L3279: code = input[i].charCodeAt(0); L3280: if (code === 48) { ... L7338: function checkPathExt(path2, options) { L7339: var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT; L7340: if (!pathext) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-QACFKPZP.jsView on unpkg · L1370

dist/desktop/plugin-worker-entry.jsView file

Lines 8-48javascript

8var CONTRIBUTION_NAME_SOURCE = "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$";

9var data = workerData;

10var port = parentPort;

11if (port === null) throw

dist/desktop/main.jsView file

12249function runShellHandler(descriptor, event, signal) { L12250: return new Promise((resolve44, reject) => { L12251: const env = { ...process.env, ...descriptor.env }; L12252: const invocation = prepareSpawnInvocation(descriptor.command, descriptor.args ?? [], { env }); L12253: const child = spawn(invocation.command, invocation.args, { L12254: env,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/desktop/main.jsView on unpkg · L12249

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/desktop/main.js: import { readFile as readFile42, stat as stat20, writeFile as writeFile19 } from "fs/promises"; baseURL: z.string().trim().url().max(2048).refine((value) => { baseURL: z2.string().url().optional(), authorizationUrl: z2.string().url().optional(), await handle.writeFile(data2); baseURL: HttpUrlInput, async function runInteractionManifest(manifest, baseUrl, createDriver) { if (!isLoopbackPreviewUrl(baseUrl)) throw new Error("D2C interaction preview must use a loopback HTTP URL");

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/desktop/main.jsView on unpkg

12291if (code !== 0) { L12292: reject(new Error(`Shell hook exited with code ${code}: ${stderr.trim()}`)); L12293: return; ... L12295: try { L12296: resolve44(HookDecisionSchema.parse(JSON.parse(stdout))); L12297: } catch (error) { ... L12300: }); L12301: child.stdin.end(JSON.stringify(event)); L12302: }); ... L12306: if (process.platform === "win32") { L12307: const killer = spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], { L12308: stdio: "ignore",

dist/chunk-JQM2L2YM.jsView file

37Cross-file remote execution chain: dist/chunk-JQM2L2YM.js spawns dist/chunk-EWD7FWTH.js; helper contains network access plus dynamic code execution. L37: var require2 = createRequire(import.meta.url); L38: var arch = process.env.npm[redacted] || process.arch; L39: var binaryName = process.platform === "win32" ? "rg.exe" : "rg"; ... L51: // src/tools/shell.ts L52: import { spawn as spawn2 } from "child_process"; L53: import { existsSync } from "fs"; ... L109: state: job.state, L110: ...job.exitCode === void 0 ? {} : { exitCode: job.exitCode }, L111: ...job.error === void 0 ? {} : { error: job.error }, ... L192: const executable = basename(command).toLowerCase(); L193: if ((executable === "cmd" || executable === "cmd.exe") && /^\/[ck]$/iu.test(args[0] ?? "")) { L194: return { command, args:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-JQM2L2YM.jsView on unpkg · L37

Source & flagged code

11 flagged · loading source

dist/cli-main.jsView file

201import { EventEmitter } from "events"; L202: import childProcess from "child_process"; L203: import path from "path";

High

Child Process

Package source references child process execution.

dist/cli-main.jsView on unpkg · L201

dist/chunk-QACFKPZP.jsView file

1#!/usr/bin/env node L2: import { createRequire as createFlavorRequire } from "node:module"; const require = createFlavorRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QACFKPZP.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

Findings

7 High5 Medium7 Low

HighChild Processdist/cli-main.js

HighSame File Env Network Executiondist/desktop/main.js

HighCredential Redirect Persistencedist/desktop/main.js

HighCommand Output Exfiltrationdist/desktop/main.js

HighCloud Metadata Accessdist/desktop/main.js

HighCross File Remote Execution Contextdist/chunk-JQM2L2YM.js

HighTrigger Reachable Command Output Exfiltrationdist/desktop/main.js

MediumDynamic Requiredist/chunk-QACFKPZP.js

MediumUnsafe Vm Contextdist/desktop/plugin-worker-entry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Low

Affected versions and remediation

This report applies to flavor-code@1.4.3.

See all versions of flavor-code for other recorded verdicts.

Review the evidence and your use of flavor-code@1.4.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 22:27:21.886Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.