@bastani/atomic
Configuration management CLI and SDK for coding agents
1
Versions
MIT
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
bastani
Keywords
coding-agentaillmclituiagent
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@dbos-inc/dbos-sdk | AI (phantom-deps): Established SDK dep, large refactor likely moved usage out of scanned scope. | ai | |
| phantom-deps | phantom-dep:embedded-postgres | AI (phantom-deps): Established DB dep likely used via native binary invocation, not JS import. | ai | |
| phantom-deps | phantom-dep:tsx | AI (phantom-deps): Build-time dependency referenced in scripts; not a runtime concern for this package. | ai | |
| source-diff | large-new-source-files | AI (source-diff): Expected growth from bundling/build output across a large monorepo package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): semver is a widely-used, benign utility library; low risk addition. | ai | |
| npm-metadata | bundled-binaries | AI (npm-metadata): pi-tui native prebuilds for darwin/win32; expected for TUI binding. | ai | |
| phantom-deps | phantom-dep:@bastani/mcp | AI (phantom-deps): Same-org runtime sibling, loaded dynamically. | ai | |
| dependencies | unvetted-dep:@bastani/web-access | AI (dependencies): workspace:* sibling in own monorepo. | ai | |
| dependencies | unvetted-dep:@bastani/mcp | AI (dependencies): workspace:* sibling in own monorepo. | ai | |
| dependencies | unvetted-dep:@bastani/intercom | AI (dependencies): workspace:* sibling in own monorepo. | ai | |
| dependencies | unvetted-dep:@bastani/subagents | AI (dependencies): workspace:* sibling in own monorepo. | ai | |
| dependencies | unvetted-dep:@bastani/workflows | AI (dependencies): workspace:* sibling in own monorepo. | ai | |
| dependencies | unvetted-dep:@bastani/atomic-natives | AI (dependencies): First-party sibling package in same org/monorepo. | ai | |
| phantom-deps | phantom-dep:@bastani/atomic-natives | AI (phantom-deps): Same-org native binding dep, not directly imported by design. | ai | |
| semgrep | semgrep:silent-process-exec-var | AI (semgrep): Same live-server daemonization pattern; benign for this package. | ai | |
| semgrep | semgrep:toplevel-fetch | AI (semgrep): Fetches localhost stop endpoint to shut down dev server; not exfiltration. | ai | |
| semgrep | semgrep:silent-process-exec | AI (semgrep): Daemonizes itself via --background flag; standard dev-server self-restart pattern, not malicious. | ai | |
| source-diff | obfuscated-file:dist/builtin/cursor/src/proto/agent_pb.ts | AI (source-diff): File is protoc-gen-es generated TypeScript with base64 proto descriptor; not obfuscation. | ai | |
| source-diff | obfuscated-file:dist/modes/interactive/components/daxnuts.js | AI (source-diff): Hex-encoded RGB pixel data for an easter-egg image render, not executable steganography. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): Used to load DOOM JS module in examples/; not in production code path. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): Windows toast notification helper in examples/; expected use of child_process. | ai | |
| source-diff | obfuscated-file:dist/builtin/mcp/app-bridge.bundle.js | AI (source-diff): Standard minified bundle of MCP SDK and zod; not obfuscated malware. | ai | |
| semgrep | semgrep:steganography-image-eval | AI (semgrep): DOOM WAD file loader in examples/ directory; not production code path. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Localhost OAuth callback URI (127.0.0.1:8080) in example extension; benign. | ai | |
| source-diff | obfuscated-file:dist/services/config/additional-instructions.d.ts | AI (source-diff): Long line is a readable Markdown string literal for AI agent instructions, not obfuscated code. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Postinstall selects platform-specific prebuilt binary from optional deps — standard native binary distribution pattern. | ai | |
| source-diff | source-size-dropped | AI (source-diff): Source shrinkage reflects intentional refactor to platform-specific binary packages, not malicious stubbing. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): commander is a declared dependency; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): yaml is a declared dependency; phantom-dep heuristic false positive for this package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode in orchestrator-entry is a documented deserialization pattern, not payload hiding. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Spreading process.env into child_process spawn options is standard CLI practice; not exfiltration. | ai |
Versions (showing 1 of 101)
| Version | Deps | Published |
|---|---|---|
| 0.5.0 | 12 / 6 |