registry  /  mastercoder  /  0.3.2

mastercoder@0.3.2

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface in this package source. The CLI launcher delegates to a platform-specific mastercoder optional dependency only when the user runs the mastercoder binary.

Static reason
One or more suspicious static signals were detected.
Trigger
user runs mastercoder CLI
Impact
executes optional dependency binary; no source evidence of exfiltration or persistence in this package
Mechanism
package-aligned binary launcher
Rationale
The scanner findings map to a user-invoked CLI wrapper that executes a package-aligned platform binary, with no lifecycle execution or source evidence of credential theft, persistence, destructive behavior, or AI-agent control-surface mutation. The README mismatch and native-binary delegation are review-relevant but do not establish malicious behavior in this package source.
Evidence
package.jsonbin/mastercoder.mjsREADME.mdmastercoder-${os.platform()}-${os.arch()}/bin/mastercoder
Network endpoints3
mastercoder.aigithub.com/latemonk/mastercoder-cli.gitopencode.ai

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
  • bin/mastercoder.mjs resolves and executes a platform optional dependency binary on user CLI invocation
  • README.md is copied from OpenCode and advertises curl/bash install commands, but they are documentation only
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle scripts
  • bin/mastercoder.mjs contains no credential/env harvesting, file writes, persistence, or network calls
  • child_process use is limited to spawnSync of package-aligned optional dependency binary with argv passthrough
  • Only package files present are package.json, README.md, and bin/mastercoder.mjs
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings