registry  /  @100xprompt/cli-darwin-arm64  /  0.1.26

@100xprompt/cli-darwin-arm64@0.1.26

AI Security Review

scanned 2h ago · by lpm-firewall-ai

`npm install` invokes `codesign` against the package-owned executable only. Direct inspection found no confirmed credential theft, exfiltration, remote payload download, destructive action, or agent-control hijack.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install
Impact
Alters the code-signature state of `bin/100xprompt`; broader runtime behavior is opaque native code.
Mechanism
removes and ad-hoc re-signs the bundled binary
Rationale
No concrete malicious behavior was established, but unconsented install-time mutation of a large opaque executable is a real unresolved supply-chain risk. This warrants a warning rather than a block.
Evidence
package.jsonbin/100xprompt

Decision evidence

public snapshot
AI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • `package.json` runs a `postinstall` hook.
  • The hook removes and ad-hoc re-signs `bin/100xprompt`.
  • `bin/100xprompt` is an opaque 115 MB Mach-O executable with bundled runtime code.
Evidence against
  • The hook targets only the package's own `bin/100xprompt`.
  • The hook has no network, credential, agent-config, or foreign-path operation.
  • No install-time execution of the binary is declared.
  • No foreign/broad AI-agent control-surface mutation was found.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 0 file(s), 0 B of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = codesign --remove-signature ./bin/100xprompt || true; codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime ./bin/100xprompt || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = codesign --remove-signature ./bin/100xprompt || true; codesign --sign - --force --preserve-metadata=entitlements,requirements,flags,runtime ./bin/100xprompt || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/100xpromptView file
•path = bin/100xprompt kind = native_binary sizeBytes = 115532224 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/100xpromptView on unpkg

Findings

1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native Binarybin/100xprompt
LowScripts Present
LowNo License