mtech-ai-local-runner@0.1.57
⚠ Under reviewAn answer names the asker's sessions linked to the Work Item. A named session now gets it only if a person typed in it in the last 30 minutes; otherwise the live session with the most recent typed prompt does, so the session that asked can be woken (Work
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package includes two native helpers that are actively invoked, but the available offline analysis could not resolve their behavior. The inspected JavaScript does not establish an attack, so manual review is needed before clearing the package.
Decision evidence
public snapshot- The package ships two native executables alongside its JavaScript source.
- JavaScript launches the Codex metadata helper and passes it a selected operation and account path.
- Offline analysis could not determine the behavior of either native executable.
- The manifest has no npm install lifecycle hook; its listed scripts cover build, packaging, and user commands.
- The JavaScript checks a compiled helper identity and validates its output, but these checks do not resolve the helper’s behavior.
Source & flagged code
5 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.57.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.57 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.