registry / gh-pull-all / 1.5.0

gh-pull-all@1.5.0

A tool to pull all git repositories in a directory with parallel processing and status display

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Normal execution downloads and evals a remote use-m loader without cryptographic verification. A compromised CDN response can execute arbitrary code in the caller's environment.

Static reason

No blocking static signals were detected.

Trigger

User runs the gh-pull-all CLI (other than help/version paths).

Impact

Remote code execution with the invoking user's permissions, including access to supplied GitHub credentials.

Mechanism

Remote JavaScript fetch followed by eval().

Rationale

This is a concrete remote-code-execution supply-chain risk, not evidence of intentional malware. The package otherwise implements its stated GitHub repository sync operations and has no install-time hook.

Evidence

gh-pull-all.mjsload-use-m.mjsgithub-repositories.mjspackage.json

Network endpoints3

unpkg.com/use-m/use.jscdn.jsdelivr.net/npm/use-m/use.jsesm.sh/use-m/use.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with false-positive risk.

gh-pull-all@1.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code