@1sat/cli@0.0.102
CLI for 1Sat Ordinals SDK
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe lifecycle hook is a local Bun version check, not an installer or payload launcher. The flagged network and key operations are explicit wallet CLI features with no concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Installation runs the Bun check; users must invoke network-capable commands.
Impact
No automatic exfiltration, persistence, or broad configuration mutation found.
Mechanism
Runtime check and user-invoked wallet CLI operations.
AI rationale
The lifecycle hook is a local Bun version check, not an installer or payload launcher. The flagged network and key operations are explicit wallet CLI features with no concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package has a preinstall hook, but it only checks whether Bun is installed.
- The MCP proxy can write a dedicated local signing key and forward stdin JSON-RPC only when the user invokes that command.
Evidence against
- The preinstall script has no network, file-write, or package-install behavior.
- No self-dependency or automatic second lifecycle chain is declared.
- Network use is confined to explicit CLI functions, including a loopback MCP proxy and an exchange-rate provider.
- No source evidence shows credential harvesting, secret exfiltration, remote code execution, or AI-agent configuration mutation.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/check-bun.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg14"scripts": {
"preinstall": "node scripts/check-bun.cjs",
"build": "bun build ./src/cli.ts --compile --outfile=bin/1sat --external pg --external pg-native --external pg-query-stream --external tedious --external oracledb --external mysql --external mariadb --external 'mariadb/*'",
Low
Suspicious Lifecycle Evidence
The package has a preinstall hook, but it only checks whether Bun is installed.
package.jsonView on unpkg · L14scripts/check-bun.cjsView file
2const { spawnSync } = require('node:child_process')
const result = spawnSync('bun', ['--version'], { stdio: 'ignore' })
if (result.error || result.status !== 0) {
Low
Suspicious Lifecycle Evidence
Findings
1 High3 Medium8 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencescripts/check-bun.cjs
LowAi Review Evidencesrc/commands/mcp-proxy.ts
LowAi Review Evidencesrc/commands/mcp-proxy.ts
Affected versions and remediation
This report applies to @1sat/cli@0.0.102.
See all versions of @1sat/cli for other recorded verdicts.
- Review the evidence and your use of @1sat/cli@0.0.102 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.