registry / portomatic / 0.2.2
portomatic@0.2.2
⚠ Under reviewSlack for testing bots, with the real Slack client.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package uses the unresolved yaml dependency to parse local manifests, so the selected runtime dependency source must be reviewed before clearing the package. The inspected device-report path does not independently establish an attack.
Static reason
One or more suspicious static signals were detected.
Trigger
A CLI command that reads a JSON or YAML manifest.
Impact
The behavior and impact of the unresolved dependency cannot be determined from the available source.
Mechanism
The CLI passes local manifest contents to yaml parsing code; that dependency could not be reviewed.
AI rationale
The package uses the unresolved yaml dependency to parse local manifests, so the selected runtime dependency source must be reviewed before clearing the package. The inspected device-report path does not independently establish an attack.
Evidence
package.jsonproducts/slack/dist/src/cli/project.js
Decision evidence
public snapshotAI called this Manual Review at 75.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json declares yaml 2.9.1, whose dependency source was not available for inspection.
- The CLI imports yaml to parse local manifest files, so the unresolved dependency is used at runtime.
Evidence against
- The reviewed device report sends a saved access token to the same service used for authentication; this alone does not establish unrelated credential disclosure.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
6 flaggedproducts/slack/dist/src/cli/run.jsView file
1var T=Object.defineProperty;var s=(r,t)=>T(r,"name",{value:t,configurable:!0});import{spawn as u}from"node:child_process";import{runtimeEnvironment as w}from"../testing/runtime.js"...
High
Child Process
Package source references child process execution.
products/slack/dist/src/cli/run.jsView on unpkg · L1products/slack/dist/src/main.jsView file
1#!/usr/bin/env node
L2: var h=Object.defineProperty;var c=(s,o)=>h(s,"name",{value:o,configurable:!0});var j=function(s,o){return typeof s=="string"&&/^\.\.?\//.test(s)?s.replace(/\.(tsx)$|((?:\.d)?)((?:\...
L3: API endpoint: ${e.apiUrl} \u2014 for bots and programmatic access only.`);else console.log(typeof r=="string"?r:JSON.stringify(r,null,2))},"emit");if(t==="help"||o.help)n(k(t==="he...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
products/slack/dist/src/main.jsView on unpkg · L1Findings
4 High4 Medium6 Low
HighChild Processproducts/slack/dist/src/cli/run.js
HighSame File Env Network Executionproducts/slack/dist/src/testing/index.js
HighCommand Output Exfiltrationproducts/slack/dist/src/testing/index.js
HighTrigger Reachable Command Output Exfiltrationproducts/slack/dist/src/testing/index.js
MediumDynamic Requireproducts/slack/dist/src/main.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptoproducts/slack/dist/src/core/avatars.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to portomatic@0.2.2.
See all versions of portomatic for other recorded verdicts.
- Review the evidence and your use of portomatic@0.2.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.