registry / @apilift/cli / 1.4.18
@apilift/cli@1.4.18
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports a warning for first-party agent plugin installation and subsequent automatic refresh, rather than malware classification. Explicit setup, ownership checks, and the absence of npm install hooks prevent a confirmed install-time agent hijack finding.
Static reason
One or more suspicious static signals were detected.
Trigger
Run apilift setup continue after linking; later eligible CLI commands can trigger automatic updates.
Impact
Changes the agent's available instructions and capabilities; later updates can change the plugin without a fresh confirmation prompt.
Mechanism
Writes the personal plugin marketplace, stages the owned plugin, invokes agent plugin commands, and refreshes linked plugins after CLI updates.
AI rationale
Source supports a warning for first-party agent plugin installation and subsequent automatic refresh, rather than malware classification. Explicit setup, ownership checks, and the absence of npm install hooks prevent a confirmed install-time agent hijack finding.
Evidence
dist/apilift.js.agents/plugins/marketplace.json.claude-plugin/marketplace.json.apilift-managed.json
Network endpoints1
apilift.dev
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json has no npm install lifecycle hooks or runtime self-dependency.
- The explicit setup continue command installs the plugin only for a linked installation with an agent identity.
- The installer stages an Apilift-owned plugin and refuses to replace an unmanaged plugin directory.
- The installer writes the personal plugin marketplace and installs or updates and enables apilift@personal.
- Eligible global CLI installations automatically check for updates unless disabled; updates refresh plugins for linked agents.
Evidence against
- The indicated collector and session-audit agent locations are tokenizer vocabulary entries, not configuration writes.
- Native-host requests require an extension handshake; inspected behavior does not establish remote payload execution or credential theft.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
Source & flagged code
4 flaggeddist/apilift.jsView file
30791// src/capture-server/client.ts
L30792: import { spawn } from "node:child_process";
L30793: import { createHash as createHash2 } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/apilift.jsView on unpkg · L30791•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/apilift.js:
transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.o...
if (v.mode === "direct" && !v.baseUrl)
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Direct transport requires baseUrl" });
if (v.baseUrl && !v.allowedOrigins.includes(parseUrl(v.baseUrl)?.origin ?? ""))
ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Base URL origin must be allowed" });
const keys = kind === "transport" ? ["mode", "baseUrl", "allowedOrigins", "browserContext", "credentials", "inject", "probes"]
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/apilift.jsView on unpkg23395sourceCode = this.opts.code.process(sourceCode, sch);
L23396: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L23397: const validate2 = makeValidate(this, this.scope.get());
Findings
3 High2 Medium7 Low
HighChild Processdist/apilift.js
HighCredential Redirect Persistencedist/apilift.js
HighCross File Remote Execution Contextdist/apilift-native-host.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/apilift.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @apilift/cli@1.4.18.
See all versions of @apilift/cli for other recorded verdicts.
- Review the evidence and your use of @apilift/cli@1.4.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.