registry / md-redline / 0.12.0
md-redline@0.12.0
Inline review comments for markdown specs. Built-in MCP server hands feedback directly to your AI agent.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe only lifecycle hook is prepublishOnly and runs a build, not during consumer installation. The flagged command-output path resolves to local CLI discovery and explicitly invoked setup, while the server’s outbound lookup requests package version metadata only.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The update lookup may run when the server starts; Claude configuration registration runs only when a user invokes mcp install.
Impact
No data disclosure, unauthorized account action, or unconsented configuration change was established.
Mechanism
The update check requests md-redline version tags from the npm registry. The CLI reads local Claude command output to check registration status and invokes the registration command only from the explicit setup subcommand.
AI rationale
The only lifecycle hook is prepublishOnly and runs a build, not during consumer installation. The flagged command-output path resolves to local CLI discovery and explicitly invoked setup, while the server’s outbound lookup requests package version metadata only.
Evidence
package.jsonbin/cli.jsbin/server-control.jsdist/server.js
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has only a prepublishOnly build hook, not a consumer install hook.
- The CLI checks local Claude CLI output and registers the server only under the explicit mcp install command; server probes use loopback.
- The server’s update check requests md-redline registry version tags and sends no local data in that request.
- The flagged bundles contain UI, parsing, diagram, and rendering code; the invisible character in the parser bundle is used as a text sentinel.
- The inspected added dependencies expose font CSS and local font files, with no lifecycle scripts.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggedbin/server-control.jsView file
1import { execSync } from 'child_process';
L2:
High
Child Process
Package source references child process execution.
bin/server-control.jsView on unpkg · L1bin/cli.jsView file
310stdio: 'ignore',
L311: shell: true,
L312: windowsHide: true,
High
4Cross-file remote execution chain: bin/cli.js spawns dist/server.js; helper contains network access plus dynamic code execution.
L4: * The published entry point is `bin/md-redline`, which exists only to import
L5: * this file. That name is what `package.json` maps both commands to, and it
L6: * cannot carry an extension; without one, `tsconfig.bin.json` could not include
...
L14:
L15: import { connect } from 'net';
L16: import { spawn } from 'child_process';
L17: import { readdirSync, statSync } from 'fs';
...
L41: const __filename = fileURLToPath(import.meta.url);
L42: const __dirname = dirname(__filename);
L43:
...
L127: try {
L128: const parsed = JSON.parse(raw);
Findings
1 Critical10 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/chunk-K5T4RW27-BEmd7tOF.js
HighChild Processbin/server-control.js
HighShellbin/cli.js
HighSame File Env Network Executionbin/cli.js#virtual:normalized:round1
HighCommand Output Exfiltrationbin/cli.js#virtual:normalized:round1
HighCross File Remote Execution Contextbin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js#virtual:normalized:round1
HighSemantic Analysis Limitedbin/cli.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/assets/chunk-OYMX7WX6-D6W21nZY.js
HighKnown Malware Source Similaritydist/assets/diagram-G4DWMVQ6-LSkPNmw2.js
Affected versions and remediation
This report applies to md-redline@0.12.0.
See all versions of md-redline for other recorded verdicts.
- Review the evidence and your use of md-redline@0.12.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.