registry / sparo-lib / 1.9.3

sparo-lib@1.9.3

A library for writing scripts that interact with Sparo

AI Security Review

scanned 16h ago · by lpm-firewall-ai

A profile-controlled selector is interpolated into a shell command when the user runs the list-profiles command with --project. This is a command-injection vulnerability, not install-time behavior.

Static reason

No blocking static signals were detected.

Trigger

User invokes Sparo list-profiles with --project against a repository containing a crafted sparse profile.

Impact

Arbitrary shell command execution in the invoking user's repository context.

Mechanism

Unquoted profile values passed to child_process.execSync

Rationale

Source inspection confirms a concrete command-injection path from schema-permitted profile content to execSync. There is no evidence of malicious install-time behavior or exfiltration.

Evidence

lib/cli/commands/list-profiles.jslib/schemas/sparo-profile.schema.jsonpackage.json

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

lib/cli/commands/list-profiles.js builds a shell string from profile selector values and calls execSync.
lib/schemas/sparo-profile.schema.json permits arbitrary string selector arguments, with no shell-character restriction.

sparo-lib@1.9.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code