registry  /  mastercoder  /  0.3.7

mastercoder@0.3.7

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface in this wrapper package. The only executable source is a user-invoked launcher for platform optional dependencies.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI binary.
Impact
Executes the resolved platform package binary with user-supplied arguments; no malicious behavior is present in this package source.
Mechanism
optional dependency binary resolution and spawnSync passthrough
Rationale
Static inspection shows a minimal CLI wrapper with no lifecycle execution and no unconsented file or agent-control-surface mutation. Scanner child_process/runtime-install signals are explained by normal CLI delegation and an error message suggesting reinstall when the platform binary is missing.
Evidence
package.jsonbin/mastercoder.mjsREADME.md

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
  • README.md appears copied from OpenCode and includes external install instructions, but it is documentation only.
Evidence against
  • package.json has no lifecycle scripts, so install does not execute package code.
  • bin/mastercoder.mjs is a user-invoked CLI shim resolving a platform optional dependency and execing its bin.
  • No credential/env harvesting, file enumeration, persistence, or agent control-surface writes found.
  • No eval/vm/Function, dynamic remote code loading, or package-source network calls found.
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings