registry / md-redline / 0.13.1
md-redline@0.13.1
Inline review comments for markdown specs. Built-in MCP server hands feedback directly to your AI agent.
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe launcher explicitly describes a layout that made the largest package file invisible to repository static checks, which leaves a real review-evasion concern. The inspected CLI behavior did not confirm an attack, so this warrants a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Running either published CLI command imports the launcher and its implementation.
Impact
The implementation may evade checks that skip extensionless files; no concrete attack effect was confirmed.
Mechanism
The extensionless launcher imports bin/cli.js, which contains the CLI implementation.
AI rationale
The launcher explicitly describes a layout that made the largest package file invisible to repository static checks, which leaves a real review-evasion concern. The inspected CLI behavior did not confirm an attack, so this warrants a warning rather than a block.
Evidence
package.jsonbin/md-redlinebin/cli.js
Network endpoints1
127.0.0.1
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The published CLI entry points import an extensionless launcher that imports the implementation file.
- The launcher says the extensionless implementation was invisible to repository static checks.
- The inspected CLI branches perform ordinary command handling and target the local server; no confirmed attack was established.
Evidence against
- The manifest’s prepublishOnly script runs the build, and no install-time hook was identified.
- Inspected CLI network requests use the local loopback server.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggedbin/server-control.jsView file
1import { execSync } from 'child_process';
L2:
High
Child Process
Package source references child process execution.
bin/server-control.jsView on unpkg · L1bin/cli.jsView file
310stdio: 'ignore',
L311: shell: true,
L312: windowsHide: true,
High
4Cross-file remote execution chain: bin/cli.js spawns dist/server.js; helper contains network access plus dynamic code execution.
L4: * The published entry point is `bin/md-redline`, which exists only to import
L5: * this file. That name is what `package.json` maps both commands to, and it
L6: * cannot carry an extension; without one, `tsconfig.bin.json` could not include
...
L14:
L15: import { connect } from 'net';
L16: import { spawn } from 'child_process';
L17: import { readdirSync, statSync } from 'fs';
...
L41: const __filename = fileURLToPath(import.meta.url);
L42: const __dirname = dirname(__filename);
L43:
...
L127: try {
L128: const parsed = JSON.parse(raw);
Findings
1 Critical10 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/chunk-K5T4RW27-C5obn5_2.js
HighChild Processbin/server-control.js
HighShellbin/cli.js
HighSame File Env Network Executionbin/cli.js#virtual:normalized:round1
HighCommand Output Exfiltrationbin/cli.js#virtual:normalized:round1
HighCross File Remote Execution Contextbin/cli.js
HighTrigger Reachable Command Output Exfiltrationbin/cli.js#virtual:normalized:round1
HighSemantic Analysis Limitedbin/cli.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/assets/chunk-OYMX7WX6-3evgGUKY.js
HighKnown Malware Source Similaritydist/assets/diagram-G4DWMVQ6-BuaraHyq.js
Affected versions and remediation
This report applies to md-redline@0.13.1.
See all versions of md-redline for other recorded verdicts.
- Review the evidence and your use of md-redline@0.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.