modelence@0.22.3
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source shows framework functionality and user-invoked development and deployment operations, without a concrete malicious chain. The prepare-only Git hook configuration and package-aligned startup tracking do not warrant blocking under the supplied policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Explicit CLI commands or application startup activate the inspected behavior.
Impact
No malicious execution, credential theft, or foreign AI-agent control mutation was established.
Mechanism
The CLI builds and uploads application files; runtime code uses configured services and standard OAuth endpoints. Startup tracking reports limited application metadata.
AI rationale
Inspected source shows framework functionality and user-invoked development and deployment operations, without a concrete malicious chain. The prepare-only Git hook configuration and package-aligned startup tracking do not warrant blocking under the supplied policy.
Evidence
.modelence.envpackage.json
Network endpoints1
cloud.modelence.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; prepare configures Git hooks, and runtime dependencies do not include itself.
- CLI builds and deployment run through explicit command actions.
- Shell execution runs the project's configured post-build command.
- Deployment authenticates with the selected service before uploading the application bundle.
- Runtime startup tracking sends project name, package version, hostname, and environment identifier to the configured service or Modelence Cloud; an environment flag disables it.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/bin/modelence.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
L4: `),console.log(`Successfully configured ${C} file`);}catch(o){console.error(`Setup failed: ${o instanceof Error?o.message:"Unknown error"}`),process.exit(1);}}var X=z.object({serve...
L5: //# sourceMappingURL=modelence.js.map
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/bin/modelence.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = modelence@0.26.0
matchedIdentity = npm:bW9kZWxlbmNl:0.26.0
similarity = 0.458
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/modelence.jsView on unpkg1#!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream,writeFileSync}from'fs';import {fileURLToPath}from'url';import N,{dirname,join}from'path';import {par...
L3: `);await promises.writeFile(o,i.trim()+`
Findings
2 Critical7 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/modelence.js
CriticalPrevious Version Dangerous Deltadist/bin/modelence.js
HighChild Processdist/bin/modelence.js
HighShell
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/chunk-AV6IY6VJ.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/chunk-AV6IY6VJ.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/modelence.js
MediumDynamic Requiredist/chunk-AV6IY6VJ.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to modelence@0.22.3.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.22.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.