AI Security Review
scanned 3d ago · by lpm-firewall-aiNo confirmed malicious attack surface is established in this package source. The package is a thin user-invoked CLI launcher for platform-specific optional dependencies.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI.
Impact
Runs the selected MasterCoder platform binary with inherited stdio; no source-level exfiltration or persistence observed here.
Mechanism
require.resolve plus spawnSync of package-aligned optional dependency binary
Rationale
Static inspection shows a package-aligned CLI shim with no lifecycle hooks and no source evidence of unconsented install-time mutation, exfiltration, or persistence. The child_process use is expected for a binary launcher and only occurs when the user invokes the CLI.
Evidence
package.jsonbin/mastercoder.mjsREADME.md
Network endpoints3
mastercoder.aigithub.com/latemonk/mastercoder-cli.gitopencode.ai
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
- bin/mastercoder.mjs invokes a platform-specific optional dependency binary with full stdio passthrough when the CLI is run.
- README.md appears copied from opencode and documents curl-based install commands, but it is inert documentation in this package.
Evidence against
- package.json defines no npm lifecycle scripts, so there is no install-time execution.
- bin/mastercoder.mjs only resolves mastercoder-${platform}-${arch}/bin/mastercoder and spawnSyncs it with user CLI args.
- No credential/env harvesting, file writes, persistence, AI-agent control-surface mutation, or network code found in package source.
- The scanner runtime install finding is an error-message suggestion, not an executed package-manager command.
Behavioral surface
ChildProcessShell
UrlStrings
Source & flagged code
2 flagged · loading sourcebin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
High
Child Process
Package source references child process execution.
bin/mastercoder.mjsView on unpkg · L33// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
...
L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`)
L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`)
L16: process.exit(1)
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/mastercoder.mjsView on unpkg · L3Findings
3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings