registry  /  mastercoder  /  0.3.39

mastercoder@0.3.39

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface in this package source. The package is a thin user-invoked CLI launcher for platform-specific optional dependency binaries; those dependencies are outside this extracted package.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI
Impact
Executes package-aligned optional dependency binary with passed CLI arguments; no install-time behavior observed in this package
Mechanism
platform binary launcher via spawnSync
Rationale
The suspicious child_process/runtime install hints are explained by a conventional CLI wrapper and an error message suggesting manual reinstall, with no lifecycle hook or hidden source behavior. README branding mismatch is sloppy/suspicious metadata but does not establish malware in the inspected package files.
Evidence
package.jsonbin/mastercoder.mjsREADME.mdmastercoder-${platform}-${arch}/bin/mastercoder
Network endpoints3
mastercoder.aimastercoder.ai/cli/opencode.ai/install

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
  • bin/mastercoder.mjs delegates execution to platform optional dependency binary
  • README.md appears copied from opencode and advertises curl install commands for a different project
Evidence against
  • package.json has no lifecycle scripts
  • bin/mastercoder.mjs only resolves mastercoder-${platform}-${arch}/bin/mastercoder and spawnSyncs it on user CLI invocation
  • No filesystem writes, credential/env harvesting, persistence, eval, or network calls in package source
  • Only files present are package.json, README.md, and bin/mastercoder.mjs
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings