mano-coding@0.1.64
Mano Coding CLI and toolchain
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe resolver's environment-token fallback is not scoped to the request host, and the downloader forwards that authorization to the metadata-provided tarball URL. This creates a credential exposure risk when package metadata points to a foreign host, so the package should be warned on rather than blocked as clearly malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user runs a command that resolves an npm package while an npm token is available.
Impact
A registry response that names a foreign tarball host could cause the user's npm token to be sent there.
Mechanism
The resolver may attach an environment token to a metadata-provided tarball URL without verifying that its host matches the configured registry.
AI rationale
The resolver's environment-token fallback is not scoped to the request host, and the downloader forwards that authorization to the metadata-provided tarball URL. This creates a credential exposure risk when package metadata points to a foreign host, so the package should be warned on rather than blocked as clearly malicious.
Evidence
dist/bin.js
Network endpoints3
registry.npmjs.org (default registry)Registry-configured npm metadata URLTarball URL host supplied by npm metadata
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The npm authorization resolver can fall back to NPM_TOKEN, NPM_AUTH_TOKEN, or MANO_NPM_AUTH_TOKEN without checking the requested URL's host.
- The resolver obtains authorization for the tarball URL supplied in npm package metadata.
- The downloader sends the resulting authorization header to that tarball URL.
Evidence against
- The package identifies itself as a CLI and exposes a command-line entry point.
- The credential flow is reached during npm package resolution, rather than through an install hook or import-time collection.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/bin.jsView file
1159var EventEmitter = __require("node:events").EventEmitter;
L1160: var childProcess = __require("node:child_process");
L1161: var path3 = __require("node:path");
High
1999}
L2000: const execArgv = process4.execArgv ?? [];
L2001: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
High
72908init_self_upgrade_pipeline();
L72909: DEFAULT_NPM_REGISTRY2 = "https://registry.npmjs.org";
L72910: }
...
L72913: // packages/cli/src/commands/auto-update.ts
L72914: import { spawn as spawn9 } from "node:child_process";
L72915: import { homedir as homedir8 } from "node:os";
...
L72917: async function scheduleAutoUpdateWorker(argv, currentVersion, options) {
L72918: const disabled = argv.includes("--offline") || Boolean(process.env["AICODING_NO_UPDATE_CHECK"]) || Boolean(process.env["CI"]) || argv[2] === "self-upgrade" || argv[2] === "_self-up...
L72919: if (disabled) return;
High
Same File Env Network Execution
Findings
6 High3 Medium6 Low
HighChild Processdist/bin.js
HighShelldist/bin.js
HighSame File Env Network Executiondist/bin.js
HighCommand Output Exfiltrationdist/bin.js
HighKnown Malware Source Similaritydist/bin.js
HighKnown Malware Source Fingerprint Signaturedist/bin.js
MediumDynamic Requirebin/mano-coding.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/bin.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to mano-coding@0.1.64.
See all versions of mano-coding for other recorded verdicts.
- Review the evidence and your use of mano-coding@0.1.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.