marky-md-to-docx@1.0.0
Convert Markdown files to DOCX format using markdown-it
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package includes agent instructions that direct agents to perform recursive external research, including Google searches, which conflicts with this review's no-network boundary. The runtime package behavior otherwise appears consistent with a Markdown editor and converter.
Static reason
No blocking static signals were detected.
Trigger
An AI coding agent reads the package's .github agent configuration.
Impact
Could cause an agent to send URLs or search queries to external services and follow additional links.
Mechanism
Instructions require recursive fetching of user-provided URLs and searching Google with a fetch tool, crossing the review's no-network boundary.
Attack narrative
When an AI agent reads the added repository instructions, it is told that extensive internet research is mandatory and directed to recursively fetch URLs and search Google. This is a review boundary escape; the package's normal converter and editor behavior does not show the same attack.
AI rationale
The package includes agent instructions that direct agents to perform recursive external research, including Google searches, which conflicts with this review's no-network boundary. The runtime package behavior otherwise appears consistent with a Markdown editor and converter.
Evidence
.github/agents/beast.agent.md.github/copilot-instructions.md
Network endpoints1
www.google.com
Decision evidence
public snapshotAI called this Malicious at 87.0% confidence as Malware with low false-positive risk.
Evidence for block
- The added agent instructions say the task cannot be solved without extensive internet research and direct agents to recursively fetch URLs.
- The same internet research directive appears in both the Beast agent file and Copilot instructions.
- The Beast agent file tells agents to search Google using a fetch tool.
- The manifest declares the Markdown converter and local server as its entry points.
- The converter reads the user-selected Markdown file and writes the requested DOCX output.
- The README describes the local server as loopback-only.
Evidence against
- The manifest has no install, preinstall, or postinstall lifecycle scripts.
- The converter's file access is tied to its command-line input and output paths.
- The browser app's CDN dependencies serve editor, diagram, math, and export features.
Behavioral surface
FilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts registry_only=start
Critical
Manifest Confusion
Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkg1{
"name": "marky-md-to-docx",
"version": "1.0.0",
"description": "Convert Markdown files to DOCX format using markdown-it",
"main": "md-to-docx.js",
"bin": {
"marky-md-to-docx": "./server.js"
},
"type": "module",
"scripts": {
"convert": "node md-
High
Ai Review Evidence
The manifest declares the Markdown converter and local server as its entry points.
package.jsonView on unpkg · L1.github/agents/beast.agent.mdView file
15THE PROBLEM CAN NOT BE SOLVED WITHOUT EXTENSIVE INTERNET RESEARCH.
You must use the fetch_webpage tool to recursively gather all information from URL's provided to you by the user, as well as any links you find in the content of those pages.
Your knowledge on everything is out of date because your
Findings
1 Critical6 High1 Medium4 Low
CriticalManifest Confusionpackage.json
HighAi Review Evidence.github/agents/beast.agent.md
HighAi Review Evidence.github/copilot-instructions.md
HighAi Review Evidence.github/agents/beast.agent.md
HighAi Review Evidencepackage.json
HighAi Review Evidencemd-to-docx.js
HighAi Review EvidenceREADME.md
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to marky-md-to-docx@1.0.0.
See all versions of marky-md-to-docx for other recorded verdicts.
- Avoid installing marky-md-to-docx@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.