modelence@0.26.3
The Node.js Framework for Real-Time MongoDB Apps
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe scanner’s CLI and network findings correspond to normal Modelence setup, authentication, and deployment behavior. The Claude Code integration writes a package-owned plugin configuration during user-invoked setup and prompts before installation; no concrete malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI setup command; Claude plugin installation proceeds only after an affirmative response in an interactive terminal.
Impact
The inspected behavior does not establish an attack surface; the plugin setup is user-invoked and consent-gated.
Mechanism
Setup writes Modelence’s plugin declaration to the project’s Claude Code settings and invokes Claude’s plugin commands after prompting.
AI rationale
The scanner’s CLI and network findings correspond to normal Modelence setup, authentication, and deployment behavior. The Claude Code integration writes a package-owned plugin configuration during user-invoked setup and prompts before installation; no concrete malicious behavior was identified.
Evidence
package.jsondist/bin/modelence.js
Network endpoints2
cloud.modelence.comdocs.modelence.com/ai-coding-agents
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the CLI and has no preinstall, install, or postinstall hook; its prepare script configures a Git hook path.
- The CLI adds Modelence’s own Claude Code plugin to project settings during setup and asks before installing it; declining skips installation.
- The CLI’s network use serves Modelence authentication and deployment operations; no host-identity exfiltration was identified.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
8 flaggeddist/bin/modelence.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = modelence@0.26.2
matchedIdentity = npm:bW9kZWxlbmNl:0.26.2
similarity = 0.958
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/bin/modelence.jsView on unpkg1#!/usr/bin/env node
L2: import {Command,Option}from'commander';import {readFileSync,promises,createWriteStream,openAsBlob}from'fs';import {fileURLToPath}from'url';import ge,{join,dirname,relative,isAbsolu...
L3: `,{mode:384});}async function Pe(e){let{hosts:t={}}=await F(),o=t[e];return !o?.token||!o.expiresAt||new Date(o.expiresAt).getTime()-Ot<=Date.now()?null:o.token}async function Ce(e...
High
Child Process
Package source references child process execution.
dist/bin/modelence.jsView on unpkg · L11#!/usr/bin/env node
L2: import {Command,Option}from'commander';import {readFileSync,promises,createWriteStream,openAsBlob}from'fs';import {fileURLToPath}from'url';import ge,{join,dirname,relative,isAbsolu...
L3: `,{mode:384});}async function Pe(e){let{hosts:t={}}=await F(),o=t[e];return !o?.token||!o.expiresAt||new Date(o.expiresAt).getTime()-Ot<=Date.now()?null:o.token}async function Ce(e...
Findings
1 Critical7 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/bin/modelence.js
HighChild Processdist/bin/modelence.js
HighShell
HighSame File Env Network Executiondist/bin/modelence.js
HighHost Fingerprint Exfiltrationdist/bin/modelence.js
HighCommand Output Exfiltrationdist/bin/modelence.js
HighSandbox Evasion Gated Capabilitydist/bin/modelence.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/modelence.js
MediumDynamic Requiredist/chunk-4LA4GKII.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to modelence@0.26.3.
See all versions of modelence for other recorded verdicts.
- Review the evidence and your use of modelence@0.26.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.