registry / @artilingo/artiframe-cli / 3.0.2

@artilingo/artiframe-cli@3.0.2

ArtiFrame — Zero-dependency native PHP framework with a powerful multilingual CLI. Scaffold projects, generate views, APIs and classes instantly.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The inspected lifecycle hook performs setup for bundled product components, and the CLI’s update action is gated by an affirmative response. These behaviors do not establish a malicious attack surface.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Package installation or a user invoking the CLI version option.

Impact

The inspected behavior performs product setup and an opt-in package update; no concrete attack surface was established.

Mechanism

Postinstall sets a bundled PHP file’s permissions, creates a default workspace and installs studio dependencies. The version option checks the npm registry and offers an interactive update.

AI rationale

Evidence

scripts/postinstall.jsbin/artiframe.js

Network endpoints1

registry.npmjs.org

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json routes the CLI through bin/artiframe.js and declares scripts/postinstall.js.
The version check contacts registry.npmjs.org for this package’s latest version.
The CLI proceeds with self-update only after an affirmative interactive response.
The postinstall script installs dependencies only in the package’s three bundled studio directories and creates a default workspace.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 14 file(s), 198 KB of source, external domains: sinavortagim.artilingo.com, windows.php.net, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

db-studio/preload.jsView file

1const { contextBridge, ipcRenderer } = require('electron'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

db-studio/preload.jsView on unpkg · L1

db-studio/main.jsView file

19}); L20: if (!projectRoot) projectRoot = process.cwd(); L21: ... L38: return await mysql.createConnection({ L39: host: process.env.DB_HOST || 'localhost', L40: user: process.env.DB_USER || 'root', ... L65: mainWindow.webContents.on('did-finish-load', () => { L66: mainWindow.webContents.send('set-app-mode', { mode: appMode, projectRoot }); L67: }); ... L92: L93: const magic = Buffer.from('ARTIFRAME\0'); L94: const encrypted = Buffer.concat([cipher.update(jsonStr, 'utf8'), cipher.final()]);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

db-studio/main.jsView on unpkg · L19

bin/artiframe.jsView file

•matchType = normalized_sha256 matchedPackage = @artilingo/artiframe-cli@2.0.0 matchedPath = bin/artiframe.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/artiframe.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

db-studio/preload.jsView file

1const { contextBridge, ipcRenderer } = require('electron'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

db-studio/preload.jsView on unpkg · L1

Findings

2 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritybin/artiframe.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredb-studio/preload.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodb-studio/main.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to @artilingo/artiframe-cli@3.0.2.

See all versions of @artilingo/artiframe-cli for other recorded verdicts.

Review the evidence and your use of @artilingo/artiframe-cli@3.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 06:29:28.307Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.