AI Security Review
scanned 3d ago · by lpm-firewall-aiNo confirmed malicious attack surface in this package source. The CLI launcher delegates to a platform-specific mastercoder optional dependency only when the user runs the mastercoder binary.
Static reason
One or more suspicious static signals were detected.
Trigger
user runs mastercoder CLI
Impact
executes optional dependency binary; no source evidence of exfiltration or persistence in this package
Mechanism
package-aligned binary launcher
Rationale
The scanner findings map to a user-invoked CLI wrapper that executes a package-aligned platform binary, with no lifecycle execution or source evidence of credential theft, persistence, destructive behavior, or AI-agent control-surface mutation. The README mismatch and native-binary delegation are review-relevant but do not establish malicious behavior in this package source.
Evidence
package.jsonbin/mastercoder.mjsREADME.mdmastercoder-${os.platform()}-${os.arch()}/bin/mastercoder
Network endpoints3
mastercoder.aigithub.com/latemonk/mastercoder-cli.gitopencode.ai
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
- bin/mastercoder.mjs resolves and executes a platform optional dependency binary on user CLI invocation
- README.md is copied from OpenCode and advertises curl/bash install commands, but they are documentation only
Evidence against
- package.json has no preinstall/install/postinstall lifecycle scripts
- bin/mastercoder.mjs contains no credential/env harvesting, file writes, persistence, or network calls
- child_process use is limited to spawnSync of package-aligned optional dependency binary with argv passthrough
- Only package files present are package.json, README.md, and bin/mastercoder.mjs
Behavioral surface
ChildProcessShell
UrlStrings
Source & flagged code
2 flagged · loading sourcebin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
High
Child Process
Package source references child process execution.
bin/mastercoder.mjsView on unpkg · L33// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
...
L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`)
L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`)
L16: process.exit(1)
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/mastercoder.mjsView on unpkg · L3Findings
3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings