registry / inplan / 0.3.0

inplan@0.3.0

⚠ Under review

inplan — a Markdown editor for human ⇄ coding-agent planning. CLI + desktop editor.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 19 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 4 file(s), 2.02 MB of source, external domains: 127.0.0.1, inplan.ai, npmmirror.com, reactjs.org, registry.npmjs.org, us.i.posthog.com, www.w3.org

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node bin/cli.js install-skill --quiet || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: // src/cli.ts L4: import { execFileSync as execFileSync2, spawn as spawn3, spawnSync } from "child_process"; L5: import { createHash as createHash4, randomBytes } from "crypto"; L6: import { createRequire } from "module"; L7: import { appendFileSync as appendFileSync3, copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync2, readFileSync as readFileSync11, realpat... L8: import { homedir as homedir7 } from "os"; ... L87: } else if (!inFence) { L88: const trimmed = line.trimStart(); L89: if (trimmed.startsWith(BLOCK_OPEN)) return of

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

app/main/index.cjsView file

2const electron = require("electron"); L3: const node_child_process = require("node:child_process"); L4: const node_crypto = require("node:crypto");

High

Child Process

Package source references child process execution.

app/main/index.cjsView on unpkg · L2

2const electron = require("electron"); L3: const node_child_process = require("node:child_process"); L4: const node_crypto = require("node:crypto"); ... L12: const os = require("os"); L13: const node_http = require("node:http"); L14: const APP_ICON_DATA_URL = "data:image/png;base64,[redacted]... L15: var BLOCK_OPEN = "<!--inplan"; ... L436: function sidecarRoot() { L437: if (process.env.INPLAN_SIDECAR_DIR) return process.env.INPLAN_SIDECAR_DIR; L438: const home = process.env.INPLAN_HOME || path.join(os.homedir(), ".inplan"); L439: return path.join(home, "sidecars"); ... L591: fs.mkdirSync(dir, { recursive: true });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

app/main/index.cjsView on unpkg · L2

bin/cli.jsView file

6import { createRequire } from "module"; L7: import { appendFileSync as appendFileSync3, copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync10, readdirSync as readdirSync2, readFileSync as readFileSync11, realpat... L8: import { homedir as homedir7 } from "os"; ... L244: // ../core/dist/node.js L245: import { appendFileSync, closeSync, existsSync, openSync, readFileSync, readSync, statSync } from "fs"; L246: import { L247: existsSync as existsSync2, L248: mkdirSync, L249: readdirSync, ... L257: watchFile, L258: writeFileSync L259: } from "fs";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/cli.jsView on unpkg · L6

2633const r = spawnSync( L2634: "powershell.exe", L2635: ["-NoProfile", "-NonInteractive", "-Command", "Expand-Archive -LiteralPath $env:INPLAN_ZIP_PATH -DestinationPath $env:INPLAN_DEST_DIR -Force"],

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L2633

1724// src/update.ts L1725: import { spawn as spawn2 } from "child_process"; L1726: var UPDATE_PKG = process.env.INPLAN_PKG || "inplan"; L1727: function compareVersions(a, b) { ... L1739: try { L1740: const res = await fetch(`https://registry.npmjs.org/${pkg.replace("/", "%2F")}/latest`, { L1741: headers: { accept: "application/json" },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L1724

app/renderer/assets/index-Cv94hl_t.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg

48331} L48332: if (!pluginMod) pluginMod = await import( L48333: /* @vite-ignore */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/renderer/assets/index-Cv94hl_t.jsView on unpkg · L48331

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•scripts.postinstall = node bin/cli.js install-skill --quiet || true

Findings

1 Critical7 High5 Medium6 Low

CriticalAi Agent Control Hijackbin/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processapp/main/index.cjs

HighShellbin/cli.js

HighSame File Env Network Executionbin/cli.js

HighUnverified Remote Native Payload Installpackage.json

HighExternal Ai Agent Control Surface Mutationbin/cli.js

HighSemantic Analysis Limitedapp/renderer/assets/index-Cv94hl_t.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireapp/renderer/assets/index-Cv94hl_t.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to inplan@0.3.0.

See all versions of inplan for other recorded verdicts.

Review the evidence and your use of inplan@0.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 18:16:00.593Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.