AI Security Review
scanned 2d ago · by lpm-firewall-aiIncluded package is a thin CLI launcher for platform-specific MasterCoder binaries. The suspicious child_process use is runtime CLI delegation, not install-time or import-time execution.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI
Impact
Executes the installed platform-specific MasterCoder binary; no confirmed malicious behavior in included source
Mechanism
spawn package-aligned optional dependency binary with forwarded arguments
Rationale
Static inspection found only a package-aligned CLI shim with no lifecycle hook, persistence, exfiltration, or unconsented AI-agent control-surface mutation in this package. The platform optional dependency binaries are not present in the inspected source, so this package alone does not establish a malicious attack surface.
Evidence
package.jsonbin/mastercoder.mjs
Network endpoints3
mastercoder.aigithub.com/latemonk/mastercoder-cli.gitmastercoder.ai/cli/
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
- bin/mastercoder.mjs uses spawnSync to execute a platform-specific optional dependency binary when CLI is invoked
- package.json optionalDependencies point to mastercoder-* native binary packages not included in this tarball
Evidence against
- package.json has no lifecycle scripts, install hooks, or postinstall execution
- bin/mastercoder.mjs only resolves mastercoder-${platform}-${arch}/bin/mastercoder and forwards argv/stdio
- No code writes agent configs, shell startup files, VCS hooks, project files, or home-directory control surfaces
- No credential/env harvesting, network calls, eval/vm/Function, or dynamic remote loading found in included source
Behavioral surface
ChildProcessShell
UrlStrings
Source & flagged code
2 flagged · loading sourcebin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
High
Child Process
Package source references child process execution.
bin/mastercoder.mjsView on unpkg · L33// optional dependency) and execs it with full stdio passthrough.
L4: import { spawnSync } from "node:child_process"
L5: import { createRequire } from "node:module"
...
L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`)
L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`)
L16: process.exit(1)
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
bin/mastercoder.mjsView on unpkg · L3Findings
3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings