mano-coding@0.1.60
0.1.60 是错误构建的版本（不含中文化与 before:input 特性），请使用 0.1.61+。0.1.60 was built from the wrong workspace; use 0.1.61 or later.
Mano Coding CLI and toolchain
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe source contains a concrete credential-forwarding path: a generic npm token can be sent to a tarball host selected by package metadata without a host check. This requires an explicit CLI package-resolution operation and a set token, but the disclosure is not requested or constrained to the token's registry.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs a CLI operation that resolves a direct npm package while NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN is set, and the registry metadata names a tarball on another host.
Impact
A package publisher or compromised registry response can receive the user's npm token, potentially enabling access to npm packages or publishing rights.
Mechanism
The resolver falls back to the environment token without checking its host against the tarball URL, then attaches that authorization header to the tarball download.
Attack narrative
When the CLI resolves a direct npm package, it reads the tarball URL from registry metadata and asks the authorization helper for credentials. If a generic npm token environment variable is set, the helper returns it without checking the tarball host. The downloader then sends that header to the metadata-selected host, allowing a package publisher or compromised metadata source to capture the token.
AI rationale
The source contains a concrete credential-forwarding path: a generic npm token can be sent to a tarball host selected by package metadata without a host check. This requires an explicit CLI package-resolution operation and a set token, but the disclosure is not requested or constrained to the token's registry.
Evidence
dist/bin.js
Network endpoints2
registry.npmjs.org (default metadata registry)Metadata-provided dist.tarball URL host (not constrained by the resolver)
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The npm authorization helper falls back to NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN without binding that fallback to a host.
- During direct npm package resolution, the tarball URL comes from package metadata; the resolver looks up authorization for that URL and stores it on the release.
- The tarball downloader sends the stored authorization header with its request to the tarball URL.
Evidence against
- The package has no install lifecycle scripts; this path runs when the CLI resolves an npm package.
- For credentials stored as host-scoped .npmrc entries, the helper checks the requested URL's host; the exposure is through the generic environment-token fallback.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/bin.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = mano-coding@0.1.47
matchedIdentity = npm:bWFuby1jb2Rpbmc:0.1.47
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin.jsView on unpkg1159var EventEmitter = __require("node:events").EventEmitter;
L1160: var childProcess = __require("node:child_process");
L1161: var path3 = __require("node:path");
High
1999}
L2000: const execArgv = process4.execArgv ?? [];
L2001: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
Findings
1 Critical4 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/bin.js
HighChild Processdist/bin.js
HighShelldist/bin.js
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
MediumDynamic Requirebin/mano-coding.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/bin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mano-coding@0.1.60.
See all versions of mano-coding for other recorded verdicts.
- Avoid installing mano-coding@0.1.60. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.