modelence@0.22.1
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection does not establish malware or an unconsented install-time data theft chain. The prepare-only VCS hook mutation is nevertheless an intrusive lifecycle side effect that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing from a source path that runs prepare; starting a Modelence application.
Impact
Unexpected repository configuration change and disclosure of host/project metadata.
Mechanism
Git hook-path mutation and package-aligned hostname telemetry
AI rationale
Source inspection does not establish malware or an unconsented install-time data theft chain. The prepare-only VCS hook mutation is nevertheless an intrusive lifecycle side effect that warrants a warning.
Evidence
package.jsondist/chunk-6Z6T3TRL.jsdist/bin/modelence.js.git/config.husky
Network endpoints1
cloud.modelence.com/api/track/app-start
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json prepare changes the consuming repo’s git hooksPath to .husky.
- Runtime startup telemetry posts local hostname and project name to Modelence Cloud unless explicitly disabled.
Evidence against
- No preinstall, install, or postinstall hook is present.
- CLI network, archive upload, file writes, and child-process calls are reachable only through named user commands.
- Telemetry endpoint is package-aligned and payload excludes environment variables, credentials, and project files.
- No AI-agent configuration writes, remote code loading, or credential harvesting found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/bin/modelence.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
High
Child Process
Package source references child process execution.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
Findings
1 Critical7 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/modelence.js
HighChild Processdist/bin/modelence.js
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/chunk-6Z6T3TRL.js
HighEntrypoint Foreign Package Code Overwritedist/bin/modelence.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/chunk-6Z6T3TRL.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/modelence.js
MediumDynamic Requiredist/bin/modelence.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to modelence@0.22.1.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.22.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.