registry  /  mastercoder  /  0.3.4

mastercoder@0.3.4

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

This package is a thin CLI wrapper that dispatches to a platform-specific optional dependency binary. The reviewed wrapper itself does not establish malicious behavior; risk depends on the separate optional binary packages not included here.

Static reason
One or more suspicious static signals were detected.
Trigger
User invokes the mastercoder CLI command.
Impact
Executes the resolved mastercoder-* binary with user-provided CLI arguments and inherited stdio.
Mechanism
platform-specific optional binary launcher
Rationale
Static inspection found a user-invoked CLI shim with no lifecycle hook, no data collection, no persistence, and no unconsented agent-control mutations. The child_process finding is package-aligned launcher behavior for optional platform binaries, not by itself a confirmed attack surface in this wrapper.
Evidence
package.jsonbin/mastercoder.mjs

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
  • bin/mastercoder.mjs resolves and executes an optional platform package binary via spawnSync.
  • package.json optionalDependencies point to platform-specific mastercoder-* packages, which are not present in this wrapper tarball.
Evidence against
  • package.json has no lifecycle scripts, so no install-time execution in this package.
  • bin/mastercoder.mjs only runs when the mastercoder CLI is invoked, not on import/install.
  • No credential/env/file harvesting, persistence, destructive behavior, or AI-agent control-surface writes found in inspected files.
  • No network code or exfiltration endpoints in package source; homepage/repository URLs are metadata/help text only.
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings