mano-coding@0.1.49
Mano Coding CLI and toolchain
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package is a coding CLI, but its npm resolver forwards a globally sourced environment token to metadata-supplied tarball hosts without checking that the host matches the registry. This is a real credential disclosure risk, though it depends on a user-run resolution flow and external metadata, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI operation that resolves an npm package while an NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN is set, and the registry metadata supplies a tarball URL on another host.
Impact
A registry response or package metadata source that supplies an external tarball URL can cause the npm token to be disclosed to that host.
Mechanism
The environment-token fallback does not restrict the token to the npm registry host. The resolver associates that token with the metadata-supplied tarball URL, and the loader sends it in the tarball request's Authorization header.
AI rationale
The package is a coding CLI, but its npm resolver forwards a globally sourced environment token to metadata-supplied tarball hosts without checking that the host matches the registry. This is a real credential disclosure risk, though it depends on a user-run resolution flow and external metadata, so it warrants a warning rather than a block.
Evidence
dist/bin.js
Network endpoints2
registry.npmjs.org (default registry)Metadata-supplied dist.tarball URL (host is not constrained)
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The resolver falls back to NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN and turns the value into a bearer authorization header.
- The resolver obtains the tarball URL from npm metadata and resolves authorization for that URL.
- The package loader forwards the resulting authorization header when fetching the tarball URL.
- The .npmrc credential lookup checks that the configured credential host matches the request host, but the environment-token fallback has no equivalent host check.
Evidence against
- The manifest presents this as a coding CLI and exposes it through a command-line entry point.
- The credential flow runs as part of npm package resolution, a normal CLI function, and requires an environment token to be present.
- The .npmrc credential path is scoped to the requested host and path.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
7 flaggeddist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = mano-coding@0.1.47
matchedIdentity = npm:bWFuby1jb2Rpbmc:0.1.47
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.jsView on unpkg1159var EventEmitter = __require("node:events").EventEmitter;
L1160: var childProcess = __require("node:child_process");
L1161: var path3 = __require("node:path");
High
1999}
L2000: const execArgv = process4.execArgv ?? [];
L2001: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processdist/bin.js
HighShelldist/bin.js
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
MediumDynamic Requirebin/mano-coding.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/bin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mano-coding@0.1.49.
See all versions of mano-coding for other recorded verdicts.
- Review the evidence and your use of mano-coding@0.1.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.