registry  /  mastercoder  /  0.3.45

mastercoder@0.3.45

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior in this package. Runtime behavior is a thin CLI launcher for package-aligned optional dependencies, but those dependency binaries are not present in this source tree.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI bin.
Impact
Executes the resolved mastercoder platform binary with user-provided arguments.
Mechanism
platform-specific optional dependency launcher via spawnSync
Rationale
Static inspection shows a small CLI shim with no lifecycle hooks or autonomous malicious behavior; the suspicious package-manager install finding is an inert error message. The unresolved risk is confined to separately packaged optional dependency binaries, not concrete attack behavior in mastercoder@0.3.45 itself.
Evidence
package.jsonbin/mastercoder.mjsREADME.mdnode_modules/mastercoder-<platform>-<arch>/bin/mastercoder
Network endpoints4
mastercoder.aimastercoder.ai/cli/opencode.aiopencode.ai/install

Decision evidence

public snapshot
AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • bin/mastercoder.mjs uses spawnSync to execute a platform optional dependency binary at user CLI runtime.
  • README.md appears copied from opencode-ai and contains unrelated curl install documentation.
Evidence against
  • package.json has no preinstall/install/postinstall scripts.
  • bin/mastercoder.mjs only resolves mastercoder-${platform}-${arch}/bin/mastercoder and passes through user CLI args/stdio.
  • The npm install string is only an error remediation message, not executed.
  • No credential/env harvesting, file writes, persistence, eval/vm, or network calls in package source.
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings