registry  /  mastercoder  /  0.3.9

mastercoder@0.3.9

MasterCoder — 기업용 AI 코딩 에이전트 (terminal CLI). 웹과 같은 회사 계정·정책·청구로 묶입니다.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

No install-time or import-time attack behavior is present in this package. The only executable behavior is a user-invoked CLI shim that delegates to a package-named platform binary optional dependency.

Static reason
One or more suspicious static signals were detected.
Trigger
User runs the mastercoder CLI binary.
Impact
Executes the resolved mastercoder platform binary with the user's CLI arguments; no confirmed malicious source behavior in this package.
Mechanism
platform-specific binary launcher via spawnSync
Rationale
Static inspection found a thin CLI launcher with no lifecycle hooks, harvesting, persistence, agent control-surface writes, or network execution path. The child_process signal is package-aligned and only triggered when the user runs the CLI, so there is no concrete malicious attack surface in this package source.
Evidence
package.jsonbin/mastercoder.mjsREADME.mdmastercoder-<platform>-<arch>/bin/mastercoder
Network endpoints4
mastercoder.aigithub.com/latemonk/mastercoder-cli.gitmastercoder.ai/cli/opencode.ai

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • bin/mastercoder.mjs uses spawnSync to execute a platform optional dependency binary on explicit CLI invocation.
  • README.md is copied from OpenCode and references opencode-ai rather than mastercoder, indicating packaging/branding inconsistency.
Evidence against
  • package.json has no preinstall/install/postinstall or other lifecycle scripts.
  • bin/mastercoder.mjs only resolves mastercoder-${platform}-${arch}/bin/mastercoder and forwards user CLI args with stdio inheritance.
  • No source reads env vars, credentials, home directories, agent configs, or project files.
  • No fetch/curl/network client code exists in executable source; URLs are metadata/docs only.
  • Package contains only package.json, README.md, and bin/mastercoder.mjs.
Behavioral surface
Source
ChildProcessShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 884 B of source, external domains: mastercoder.ai

Source & flagged code

2 flagged · loading source
bin/mastercoder.mjsView file
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module"
High
Child Process

Package source references child process execution.

bin/mastercoder.mjsView on unpkg · L3
3// optional dependency) and execs it with full stdio passthrough. L4: import { spawnSync } from "node:child_process" L5: import { createRequire } from "node:module" ... L14: console.error(`MasterCoder: 이 플랫폼(${os.platform()}-${os.arch()})용 실행 파일을 찾지 못했어요.`) L15: console.error(`해결: npm install -g mastercoder --force · 안내: https://mastercoder.ai/cli/`) L16: process.exit(1)
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/mastercoder.mjsView on unpkg · L3

Findings

3 High1 Low
HighChild Processbin/mastercoder.mjs
HighShell
HighRuntime Package Installbin/mastercoder.mjs
LowUrl Strings