registry / md-redline / 0.11.0
md-redline@0.11.0
Inline review comments for markdown specs. Built-in MCP server hands feedback directly to your AI agent.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe inspected source does not establish a concrete attack, and the manifest has no install hook. The launcher’s comments explicitly draw attention to static-check blind spots, so this review retains a warning rather than treating the scanner’s malware label as proof.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Invoking either published command loads the CLI; MCP configuration setup runs only when the user invokes its install subcommand.
Impact
No concrete harmful effect is confirmed; the unexplained emphasis on static-check visibility warrants a warning.
Mechanism
The CLI performs local server management and local API requests. The reviewed excerpts do not show an external recipient or credential transfer.
AI rationale
The inspected source does not establish a concrete attack, and the manifest has no install hook. The launcher’s comments explicitly draw attention to static-check blind spots, so this review retains a warning rather than treating the scanner’s malware label as proof.
Evidence
bin/md-redlinebin/cli.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package has no install lifecycle hook; its publish hook runs the build.
- The published launcher imports the CLI, which runs when the command is invoked.
- The launcher comments that the main CLI file was moved because it was invisible to the repository’s static gates.
- The inspected CLI network calls target the local server, and MCP configuration changes require an explicit install subcommand.
Evidence against
- The reviewed CLI excerpts do not establish credential collection, external data transfer, or an attack.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggedbin/server-control.jsView file
1import { execSync } from 'child_process';
L2:
High
Child Process
Package source references child process execution.
bin/server-control.jsView on unpkg · L1bin/cli.jsView file
310stdio: 'ignore',
L311: shell: true,
L312: windowsHide: true,
High
4Cross-file remote execution chain: bin/cli.js spawns dist/server.js; helper contains network access plus dynamic code execution.
L4: * The published entry point is `bin/md-redline`, which exists only to import
L5: * this file. That name is what `package.json` maps both commands to, and it
L6: * cannot carry an extension; without one, `tsconfig.bin.json` could not include
...
L14:
L15: import { connect } from 'net';
L16: import { spawn } from 'child_process';
L17: import { readdirSync, statSync } from 'fs';
...
L41: const __filename = fileURLToPath(import.meta.url);
L42: const __dirname = dirname(__filename);
L43:
...
L127: try {
L128: const parsed = JSON.parse(raw);
Findings
1 Critical10 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/chunk-K5T4RW27-CauE2VDN.js
HighChild Processbin/server-control.js
HighShellbin/cli.js
HighSame File Env Network Executionbin/cli.js#virtual:normalized:round1
HighCommand Output Exfiltrationbin/cli.js#virtual:normalized:round1
HighCross File Remote Execution Contextbin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js#virtual:normalized:round1
HighSemantic Analysis Limitedbin/cli.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/assets/chunk-OYMX7WX6-BUA_pFV5.js
HighKnown Malware Source Similaritydist/assets/diagram-G4DWMVQ6-yH1TCTlc.js
Affected versions and remediation
This report applies to md-redline@0.11.0.
See all versions of md-redline for other recorded verdicts.
- Review the evidence and your use of md-redline@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.