md-redline@0.9.1
Inline review comments for markdown specs. Built-in MCP server hands feedback directly to your AI agent.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe published command’s source explicitly describes hiding its implementation from static gates and keeping the wrapper small so further changes remain unchecked. That is deliberate review evasion and warrants blocking despite no separate exfiltration behavior being established in the inspected paths.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Invoking either published CLI command imports bin/cli.js; static analysis of the wrapper encounters an explicit instruction to keep it small.
Impact
This deliberate review and analysis evasion can conceal package behavior from security checks; the inspected paths did not establish a separate data theft payload.
Mechanism
The wrapper states that moving the implementation to cli.js made the largest file invisible to every static gate and says additions to the wrapper would be unchecked.
Attack narrative
The package maps both commands to a short wrapper that imports the substantive CLI implementation. The wrapper explicitly says this move made the largest file invisible to every static gate and instructs maintainers to keep the wrapper small so additions remain unchecked. This is deliberate review evasion. The inspected runtime paths did not establish an unrelated collector or credential theft behavior.
AI rationale
The published command’s source explicitly describes hiding its implementation from static gates and keeping the wrapper small so further changes remain unchecked. That is deliberate review evasion and warrants blocking despite no separate exfiltration behavior being established in the inspected paths.
Evidence
package.jsonbin/md-redlinebin/cli.js
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- Both published commands map to bin/md-redline, which imports bin/cli.js.
- The wrapper says moving the implementation made the largest file invisible to every static gate and directs maintainers to keep the wrapper small.
- The imported CLI describes its command behavior as running on import.
Evidence against
- The inspected CLI network requests target localhost for server checks and access grants.
- The server’s update checker uses the npm registry, consistent with update checking.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flaggedbin/cli.jsView file
36const APP_DIR = resolve(__dirname, '..');
L37: const require = createRequire(import.meta.url);
L38: const { version: CLI_VERSION } = require(join(APP_DIR, 'package.json'));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L36dist/assets/chunk-K5T4RW27-MpR5OiPe.jsView file
76contains invisible/control Unicode U+200B (zero width space)
`&&r++}n&&t.length>0&&e.push(t.length),this._lineOffsets=e}return this._lineOffsets}positionAt(e){e=Math.max(Math.min(e,this._content.length),0);let t=this.getLineOffsets(),n=0,r=t.length;if(r===0)return q.create(0,e);for(;n<r;){let i=Math.
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/assets/chunk-K5T4RW27-MpR5OiPe.jsView on unpkg · L76bin/cli.js#virtual:normalized:round1View file
Findings
1 Critical6 High4 Medium5 Low
CriticalTrojan Source Unicodedist/assets/chunk-K5T4RW27-MpR5OiPe.js
HighSemantic Analysis Limitedbin/cli.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/assets/chunk-OYMX7WX6-CxGl_Vxi.js
HighKnown Malware Source Similaritydist/assets/diagram-G4DWMVQ6-BQbAgZWs.js
HighKnown Malware Source Similaritydist/assets/flowDiagram-DWJPFMVM-CGHojnmt.js
HighKnown Malware Source Similaritydist/assets/wardleyDiagram-NUSXRM2D-CkikHckV.js
HighPrevious Version Dangerous Deltadist/server.js
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to md-redline@0.9.1.
See all versions of md-redline for other recorded verdicts.
- Avoid installing md-redline@0.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.