registry / @aicraftalchemy/aca / 0.0.41

@aicraftalchemy/aca@0.0.41

ACA — agentic coding CLI. Any model, any provider (Claude, Gemini, OpenAI, NVIDIA, Groq, Cerebras, OpenRouter, Hugging Face). Developed by Aicraftalchemy.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install-time code fetches opaque native binaries and a VSIX from a remote release host. The checksum manifest is retrieved from that same remotely controlled release location, so the packaged JavaScript cannot independently authenticate the payload.

Static reason

One or more suspicious static signals were detected.

Trigger

`npm install` activates `postinstall`; invoking `aca` executes the downloaded binary.

Impact

A compromised or redirected release source can supply a verified-by-self manifest and executable that is then written and launched.

Mechanism

Remote manifest-selected binary bootstrap and runtime launcher

Rationale

This package is an opaque remote binary bootstrapper with install-time execution and no independent payload authenticity anchor. Its source does not prove malicious behavior, but it is a concrete staged payload carrier unsuitable for a clean verdict.

Evidence

package.jsoninstall.cjscli-wrapper.cjsREADME.mdbin/acabin/aca.exebin/rgbin/rg.exebin/aca.vsixbin/.aca-bin-versionbin/.aca-pending-version

Network endpoints2

github.com/lokeshe09/aca-releases/releases/download/v0.0.41github.com

@aicraftalchemy/aca@0.0.41

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code