registry / @artilingo/artiframe-cli / 2.0.5
@artilingo/artiframe-cli@2.0.5
ArtiFrame — Zero-dependency native PHP framework with a powerful multilingual CLI. Scaffold projects, generate views, APIs and classes instantly.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe automatic hook performs setup for the package's own bundled studios. The CLI's global update is gated by user confirmation, and the inspected source establishes no concrete attack behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Package installation runs the postinstall hook; the CLI update path runs when the user requests version information and accepts an offered update.
Impact
These actions support the bundled CLI and studios; no concrete malicious impact was established.
Mechanism
The hook adjusts a bundled file's permissions, creates a default ArtiFrame workspace, and installs dependencies in bundled studio directories. The CLI checks the npm registry and gates its global update on user confirmation.
AI rationale
The automatic hook performs setup for the package's own bundled studios. The CLI's global update is gated by user confirmation, and the inspected source establishes no concrete attack behavior.
Evidence
bin/artiframe.php~/ArtiFrame/README.txtdevops-studio/db-studio/server-studio/
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a postinstall hook that runs the package's own setup script.
- The setup script changes the bundled PHP launcher permission, creates a product-named workspace if absent, and runs npm install in three bundled studio directories.
- The CLI checks for updates against the npm registry and only invokes a global package update after an affirmative response.
Evidence against
- The inspected install and entrypoint behavior is consistent with setting up and running the bundled CLI studios; no concrete malicious behavior was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdb-studio/preload.jsView file
1const { contextBridge, ipcRenderer } = require('electron');
L2:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
db-studio/preload.jsView on unpkg · L1Findings
2 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritybin/artiframe.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredb-studio/preload.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodb-studio/main.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @artilingo/artiframe-cli@2.0.5.
See all versions of @artilingo/artiframe-cli for other recorded verdicts.
- Review the evidence and your use of @artilingo/artiframe-cli@2.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.