registry  /  mastercoder  /  0.3.5

mastercoder@0.3.5

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface in this package source. The only executable code is a user-invoked CLI shim that delegates to a platform-specific optional dependency.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI
Impact
Executes the package-aligned platform binary if installed; no source evidence of exfiltration or persistence in this wrapper package.
Mechanism
CLI binary delegation via spawnSync
Rationale
Static inspection shows a thin CLI launcher with no install-time execution and no data theft, persistence, or AI-agent control-surface writes. Scanner findings map to package-aligned child_process use activated only when the user runs the CLI.
Evidence
package.jsonbin/mastercoder.mjsREADME.mdmastercoder-<platform>-<arch>/bin/mastercoder

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no npm lifecycle scripts
    • bin/mastercoder.mjs only resolves a platform optional dependency and spawnSyncs its bin on explicit CLI use
    • No fs writes, env/credential harvesting, eval/vm, network code, persistence, or agent control-surface mutation found
    • README contains OpenCode install/docs links but no package-executed behavior
    Behavioral surface
    Source
    ChildProcessShell
    Supply chain
    UrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

    Source & flagged code

    2 flagged · loading source
    bin/mastercoder.mjsView file
    3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
    High
    Child Process

    Package source references child process execution.

    bin/mastercoder.mjsView on unpkg · L3
    3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
    High
    Runtime Package Install

    Package source invokes a package manager install command at runtime.

    bin/mastercoder.mjsView on unpkg · L3

    Findings

    3 High1 Low
    HighChild Processbin/mastercoder.mjs
    HighShell
    HighRuntime Package Installbin/mastercoder.mjs
    LowUrl Strings