modelence@0.25.1
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 2mo ago · by lpm-firewall-aiScanner exfiltration and install-hook labels do not match the source: there are no registry install hooks, and network plus process use is the first-party Modelence CLI and runtime. The remaining issue is that modelence setup writes Claude Code project settings and can install the vendor plugin after a prompt, which is user-invoked first-party agent setup rather than a publish-blocking attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the modelence setup command.
Impact
The consumer project's Claude Code settings can enable the Modelence plugin; this is not an npm install-time hijack of a foreign agent.
Mechanism
User-command first-party Claude Code plugin enablement
AI rationale
Scanner exfiltration and install-hook labels do not match the source: there are no registry install hooks, and network plus process use is the first-party Modelence CLI and runtime. The remaining issue is that modelence setup writes Claude Code project settings and can install the vendor plugin after a prompt, which is user-invoked first-party agent setup rather than a publish-blocking attack.
Evidence
dist/bin/modelence.js.claude/settings.json
Network endpoints1
docs.modelence.com/ai-coding-agents
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The modelence setup CLI writes the consumer project's .claude/settings.json to declare a GitHub marketplace and enable the modelence@modelence Claude Code plugin without a separate prompt for that file write.
- If the user accepts a yes/no prompt, setup runs the local claude CLI with spawnSync to add marketplace modelence/modelence and install plugin modelence@modelence at project scope.
Evidence against
- package.json has no preinstall, install, or postinstall scripts; prepare only sets this monorepo's husky git hooks path.
- CLI and runtime network use first-party hosts such as cloud.modelence.com for setup, deploy, and opt-out app-start tracking, not a third-party drop.
- child_process in the CLI is used for documented build/dev/start plus the optional first-party Claude plugin install.
- App-start tracking posts only project name, package version, hostname, and environment id, and is skipped when MODELENCE_TRACKING_ENABLED is false.
- The Claude plugin IDs are vendor-owned (modelence@modelence from modelence/modelence), and an existing enabledPlugins false value is left unchanged.
Behavioral surface
Source & flagged code
9 flaggeddist/bin/modelence.jsView file
1Source sends the broad process environment to a literal external destination.
L1: #!/usr/bin/env node
L2: import {Command}from'commander';import {readFileSync,promises,createWriteStream}from'fs';import {fileURLToPath}from'url';import L,{join,dirname}from'path';import {parse}from'dotenv...
L3: `);}var j=".claude",w=join(j,"settings.json"),N="modelence@modelence",I="modelence/modelence",ae={modelence:{source:{source:"github",repo:I}}},ce="https://docs.modelence.com/ai-cod...
...
L6: Guide: ${ce}`;async function le(){let e=join(process.cwd(),w),t;try{t=await promises.readFile(e,"utf8");}catch(n){if(n.code!=="ENOENT"){console.warn(`Could not read ${w}; leaving i...
L7: `),console.log(`Declared the Modelence Claude Code plugin in ${w}`);}catch(n){console.warn(`Failed to write ${w}:`,n);}}functi
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/bin/modelence.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = modelence@0.25.0
matchedIdentity = npm:bW9kZWxlbmNl:0.25.0
similarity = 0.875
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/modelence.jsView on unpkgFindings
2 Critical6 High4 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/bin/modelence.js
CriticalPrevious Version Dangerous Deltadist/bin/modelence.js
HighChild Processdist/bin/modelence.js
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/chunk-IKIOVFVD.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/bin/modelence.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/modelence.js
MediumDynamic Requiredist/bin/modelence.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to modelence@0.25.1.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.25.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.