modelence@0.21.0
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not concrete malware, but the install-time Git configuration mutation is an unconsented project-level side effect and warrants a warning. Telemetry is package-aligned but default-on and transmits host identity metadata.
Static reason
One or more suspicious static signals were detected.
Trigger
Package prepare lifecycle; application startApp runtime initialization
Impact
Repository hook behavior changes; host and project metadata disclosure to the configured service
Mechanism
Git hook configuration mutation and default-on telemetry
AI rationale
This is not concrete malware, but the install-time Git configuration mutation is an unconsented project-level side effect and warrants a warning. Telemetry is package-aligned but default-on and transmits host identity metadata.
Evidence
package.jsondist/chunk-3SGMDISS.jsdist/bin/modelence.js
Network endpoints2
cloud.modelence.com/api/track/app-startcloud.modelence.com
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json prepare changes Git core.hooksPath after cd ../..
- dist/chunk-3SGMDISS.js sends hostname and project name to Modelence Cloud by default
- Telemetry runs from startApp initialization and ignores failures
- dist/bin/modelence.js deploy uploads a user project bundle after explicit deploy command
Evidence against
- No preinstall, install, or postinstall hook
- CLI shell commands are limited to explicit build/dev/start flows
- Cloud endpoints and bundle upload are Modelence product functions
- No eval, Function constructor, or hidden remote-code loader found
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/bin/modelence.jsView file
1#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
High
Child Process
Package source references child process execution.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
Findings
5 High7 Medium6 Low
HighChild Processdist/bin/modelence.js
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/chunk-3SGMDISS.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/chunk-3SGMDISS.js
MediumDynamic Requiredist/bin/modelence.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/client.d.ts
MediumSecret Patterndist/client.d.ts
MediumSecret Patterndist/client.d.ts
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to modelence@0.21.0.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.21.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.