mtech-ai-local-runner@0.1.65
⚠ Under reviewAn answer to a colleague ask now goes first to the session that made the ask, when the asking AI passed its client session id (Work Item e1c08b33). Among the sessions an answer names, the runner takes the one listed first, as long as a person typed in it
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no npm install hook, and the inspected agent integration setup is invoked through an explicit CLI command. The behavior of two shipped native executables remains unresolved, so the package cannot be marked clean or classified as malicious from this evidence.
Decision evidence
public snapshot- package.json lists build, prepack, and explicit CLI scripts; it has no preinstall, install, or postinstall hook.
- The CLI routes the explicit integrations command to integration setup, which writes Claude plugin configuration.
- The required integrations excerpt shows configuration files are written through a temporary file and atomic rename.
- Trusted offline analyses could not resolve the behavior of either shipped native executable.
- The inspected integration setup is reached through the explicit CLI command, not an npm install hook.
- No concrete attack was established from the inspected JavaScript; the native executables remain unresolved.
Source & flagged code
5 flaggedPackage text addresses the security reviewer or scanner and tries to influence the review outcome.
README.mdView on unpkgPackage source references dynamic require/import behavior.
dist/src/adapters/codex/pre-model-gate.jsView on unpkg · L29Findings
Affected versions and remediation
This report applies to mtech-ai-local-runner@0.1.65.
See all versions of mtech-ai-local-runner for other recorded verdicts.
- Review the evidence and your use of mtech-ai-local-runner@0.1.65 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.