registry  /  mastercoder  /  0.3.52

mastercoder@0.3.52

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established in this package source. The CLI wrapper executes a package-aligned optional dependency binary only when the user runs the mastercoder command.

Static reason
One or more suspicious static signals were detected.
Trigger
User invokes the mastercoder CLI bin.
Impact
Runs the resolved MasterCoder platform binary with user-supplied CLI arguments; no malicious behavior is present in this wrapper source.
Mechanism
platform-specific optional dependency launcher
Rationale
Static inspection found a normal npm meta-package launcher with no lifecycle execution, exfiltration, persistence, destructive behavior, or unconsented AI-agent control-surface mutation. The child_process finding is package-aligned runtime behavior for a CLI wrapper rather than a concrete attack chain.
Evidence
package.jsonbin/mastercoder.mjsREADME.md

Decision evidence

public snapshot
AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • bin/mastercoder.mjs uses child_process.spawnSync to launch a resolved platform binary from optional dependency mastercoder-${platform}-${arch}.
  • README.md appears copied from opencode and includes curl install documentation, but it is documentation only and not executed by this package.
Evidence against
  • package.json has no preinstall/install/postinstall/prepare lifecycle scripts.
  • bin/mastercoder.mjs only resolves a package-aligned optional dependency and forwards CLI args/stdio.
  • No source reads credentials, environment secrets, SSH/npm files, or project files.
  • No code writes files, mutates agent configuration, establishes persistence, or performs network requests.
  • No eval/vm/Function, obfuscation, or remote payload download found in package files.
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings