AI Security Review
scanned 2d ago · by lpm-firewall-aiNo confirmed malicious attack surface in the inspected source. The only executable package code is a user-invoked CLI shim that launches a package-aligned optional dependency binary.
Static reason
One or more suspicious static signals were detected.
Trigger
user runs the mastercoder CLI
Impact
delegates execution to the installed mastercoder platform package; no install-time or import-time behavior in this package
Mechanism
platform optional-dependency binary launcher
Rationale
The scanner signals are explained by a normal CLI wrapper: child_process is used only after explicit CLI invocation to run the platform-specific MasterCoder binary. There is no lifecycle hook, persistence, exfiltration, foreign agent control-surface write, or runtime package installation in the inspected source.
Evidence
package.jsonbin/mastercoder.mjsREADME.md
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
- bin/mastercoder.mjs uses child_process.spawnSync to execute a platform-specific optional dependency binary when the CLI is invoked.
- README.md contains unrelated OpenCode installation/docs links, but they are documentation only and not executed by this package.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle scripts.
- Published files are limited to package.json, README.md, and bin/mastercoder.mjs.
- bin/mastercoder.mjs only resolves mastercoder-${platform}-${arch}/bin/mastercoder and passes CLI args/stdio through.
- No source writes files, mutates agent control surfaces, reads credentials/env secrets, or performs network requests.
Behavioral surface
ChildProcessShell
UrlStrings
Source & flagged code
2 flagged · loading sourcebin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
High
Child Process
Package source references child process execution.
bin/mastercoder.mjsView on unpkg · L33// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
...
L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`)
L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`)
L16: process.exit(1)
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/mastercoder.mjsView on unpkg · L3Findings
3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings