registry / 100xprompt-cli / 0.1.43

100xprompt-cli@0.1.43

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time code mutates first-party configuration under the user's home directory and normalizes a selected platform binary. No confirmed exfiltration, remote payload retrieval, or foreign AI-agent control-surface write is present in the inspected files.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; later explicit `100xprompt` CLI invocation

Impact

Unconsented install-time persistence in the package-owned config namespace and macOS ad-hoc binary re-signing.

Mechanism

first-party config provisioning plus platform-binary permission/signature setup

Rationale

This is not concrete malware, but automatic first-party agent configuration mutation and binary re-signing at postinstall are meaningful lifecycle risk. The available source does not establish a malicious chain.

Evidence

package.jsonpostinstall.mjsbin/100xprompt.jsbin/100xprompt~/.config/100xprompt/100xprompt.json~/.100xprompt/100xprompt.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

100xprompt-cli@0.1.43

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code