registry / @apilift/cli / 1.0.2
@apilift/cli@1.0.2
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe source establishes a guarded, explicit user-command agent plugin installation capability. Under the agent integration policy, this is a warning-level extension lifecycle risk rather than confirmed malware.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the apilift setup continue command with an agent session.
Impact
This grants the package's setup skill access through the selected agent platform after explicit setup.
Mechanism
The setup handler calls the plugin installer, which invokes agent CLI plugin commands.
AI rationale
The source establishes a guarded, explicit user-command agent plugin installation capability. Under the agent integration policy, this is a warning-level extension lifecycle risk rather than confirmed malware.
Evidence
dist/apilift.jsplugins/apilift.agents/plugins
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit setup continue command invokes the agent plugin installer.
- The installer adds an Apilift plugin to Codex or Claude user plugin management.
- The package metadata exposes CLI binaries and contains no install lifecycle hook.
Evidence against
- The plugin setup is reached through an explicit CLI setup command, not automatically during npm installation.
- No credential exfiltration or remote payload execution was identified in the inspected paths.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/apilift.jsView file
30791// src/capture-server/client.ts
L30792: import { spawn } from "node:child_process";
L30793: import { createHash as createHash2 } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/apilift.jsView on unpkg · L30791•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.o...
if (v.mode === "direct" && !v.baseUrl)
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Direct transport requires baseUrl" });
if (v.baseUrl && !v.allowedOrigins.includes(parseUrl(v.baseUrl)?.origin ?? ""))
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Base URL origin must be allowed" });
const keys = kind === "transport" ? ["mode", "baseUrl", "allowedOrigins", "browserContext", "credentials", "inject", "probes"]
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/apilift.jsView on unpkg23395sourceCode = this.opts.code.process(sourceCode, sch);
L23396: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23397: const validate2 = makeValidate(this, this.scope.get());
Findings
3 High2 Medium7 Low
HighChild Processdist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift-native-host.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/apilift.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.0.2.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.