registry / @airstrings/cli / 0.13.6

@airstrings/cli@0.13.6

CLI for the AirStrings remote string management platform

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Postinstall downloads a platform-specific AirStrings binary, verifies its SHA-256 against the release manifest, and extracts it to package-local `vendor/`. CLI entrypoints then run that local binary with user-supplied arguments. No confirmed malicious source-level attack surface is established.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall; later explicit `airstrings` or `airstrings-mcp` invocation

Impact

Installs and executes the package's declared native CLI binary; no credential harvesting, exfiltration, persistence, or foreign control-surface mutation appears in inspected JavaScript.

Mechanism

verified release-binary bootstrap and local CLI delegation

Rationale

The postinstall hook is a transparent native-binary bootstrap consistent with this CLI package and is constrained to a versioned GitHub release path and package-local files. Static inspection finds no concrete malicious behavior.

Evidence

package.jsoninstall.jslib/binary.jslib/checksums.jslib/run.jsbin/airstrings.jsbin/airstrings-mcp.jsvendor/

Network endpoints1

github.com/symbionix-sl/homebrew-airstrings/releases/download/v0.13.6

@airstrings/cli@0.13.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code