registry / @angelmsger/bitbucket-cli / 0.13.1

@angelmsger/bitbucket-cli@0.13.1

Drive Bitbucket pull requests and repositories from the terminal — built for coding agents: list/get/diff/approve/merge PRs, browse source at any ref, post inline review comments, and fetch a PR into a local git checkout. Supports Bitbucket Cloud and Data

AI Security Review

scanned 16h ago · by lpm-firewall-ai

The postinstall downloader stages an opaque native binary from GitHub into the package directory. The CLI launcher later executes that binary, whose behavior is not present in the inspected package source.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall; invoking `bitbucket-cli` executes the staged binary.

Impact

A compromised or substituted release payload could execute with the installing user's permissions.

Mechanism

install-time remote binary download followed by runtime native execution

Rationale

Source inspection finds a package-aligned binary installer, not direct malicious behavior, but the install-time opaque executable staging and weak optional verification create a real supply-chain execution risk. Treat as a warning rather than a publish block.

Evidence

package.jsoninstall.jsbin/bitbucket-cli.jsREADME.mdbinary/bitbucket-clibinary/bitbucket-cli.exe

Network endpoints1

github.com/AngelMsger/bitbucket-cli/releases/download/v0.13.1

Decision evidence

public snapshot

AI called this at 87.0% confidence with false-positive risk.

@angelmsger/bitbucket-cli@0.13.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code