mano-coding@0.1.55
Mano Coding CLI and toolchain
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe npm resolver can send environment-provided npm credentials to an arbitrary host named by registry metadata, without verifying that the tarball host belongs to the configured registry. This is credential exfiltration triggered by package resolution.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user invokes the CLI to resolve an npm package while an npm token environment variable is set, and the registry returns a tarball URL on another host.
Impact
A registry response can cause the user’s npm token to be disclosed to an unrelated host.
Mechanism
The resolver applies the environment token as authorization for the metadata-provided tarball URL, then sends that header with the tarball request without checking that the host matches the configured registry.
Attack narrative
During npm package resolution, the CLI reads a tarball URL from registry metadata and resolves authorization for that URL. If no host-matched npmrc credential is found, it uses NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN without a host restriction, then sends the resulting authorization header to the tarball URL. A registry response can therefore direct the user’s token to an unrelated host.
AI rationale
The npm resolver can send environment-provided npm credentials to an arbitrary host named by registry metadata, without verifying that the tarball host belongs to the configured registry. This is credential exfiltration triggered by package resolution.
Evidence
dist/bin.js
Network endpoints2
registry.npmjs.org (default npm registry)Metadata-provided tarball URL host (dynamic)
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The npm resolver falls back to NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN without restricting the token to a registry host.
- The resolver takes the tarball URL from registry metadata and resolves authorization for that URL.
- The tarball downloader sends the resolved authorization header to the tarball URL.
Evidence against
- The behavior is part of the package’s npm resolution functionality.
- The credential is sent during package resolution, rather than by an install hook or ordinary import.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = mano-coding@0.1.47
matchedIdentity = npm:bWFuby1jb2Rpbmc:0.1.47
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.jsView on unpkg1159var EventEmitter = __require("node:events").EventEmitter;
L1160: var childProcess = __require("node:child_process");
L1161: var path3 = __require("node:path");
High
1999}
L2000: const execArgv = process4.execArgv ?? [];
L2001: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processdist/bin.js
HighShelldist/bin.js
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
MediumDynamic Requirebin/mano-coding.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/bin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mano-coding@0.1.55.
See all versions of mano-coding for other recorded verdicts.
- Avoid installing mano-coding@0.1.55. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.