registry / Data exfiltration / @astrale-os/cli

@astrale-os/cli

Astrale CLI — connect to existing Astrale kernels

This report shows the evidence for @astrale-os/cli@0.6.3-alpha.0. 1 of 7 known versions is blocked or flagged. The newest version, 1.0.0-npm-deprecated.0, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete, default-on, automatic data-collection and external-agent execution chain, not a scanner-only primitive. The benign preinstall guard does not mitigate the runtime exfiltration behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Run normal `astrale` commands, allow a session to become idle, then run `astrale` again with telemetry enabled by default.

Impact

Potential exfiltration of local workspace and AI-agent transcript contents to the Claude service without an explicit analysis command or consent.

Mechanism

Automatic local agent-transcript and workspace collection through headless Claude.

Attack narrative

The package defaults telemetry to enabled, records regular CLI invocations, and on a later CLI start automatically analyzes a closed session. That analysis locates local Codex and Claude Code transcript files for the workspace, launches `claude -p`, and explicitly authorizes filesystem inspection of those transcripts and the workspace. Headless Claude analysis is not restricted to an explicit user `session analyze` request, so local developer and agent data can be supplied to an external model service without consent.

AI rationale

Evidence

package.json.check-workspace.cjsdist/astrale.jssrc/telemetry/settings.tssrc/telemetry/trigger.tssrc/telemetry/analyze.tssrc/telemetry/adapters/codex.tssrc/telemetry/adapters/claude-code.tssrc/telemetry/recorder.ts~/.astrale/sessions/<id>/~/.codex/sessions/~/.claude/projects/

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

`src/telemetry/settings.ts` enables telemetry by default when no config exists.
`dist/astrale.js` calls `beginInvocation` and `maybeTriggerAnalysis` on ordinary non-session CLI starts.
`src/telemetry/analyze.ts` discovers overlapping Codex/Claude transcripts and directs `claude -p` to inspect them and the workspace.
`src/telemetry/analyze.ts` permits Claude `Read`, `Glob`, `Grep`, `LS`, and `Bash(astrale:*)`, then logs its output locally.

Evidence against

`.check-workspace.cjs` is a non-mutating workspace-install guard.
No preinstall code writes agent configuration or launches network/process payloads.
The separate `.claude/skills` symlink is only reached through explicit `astrale setup` and avoids clobbering existing paths.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

9 flagged

package.jsonView file

Lines 62-92json

62 "husky": "~9.1.7",

63 "lint-staged": "~16.2.7",

64 "msgpackr": "^1.12.1",

65 "oxfmt": "0.52.0",

66 "oxlint": "latest",

67 "typescript": "~6.0.1-rc"

68 },

69 "lint-staged": {

70 "*.{js,cjs,mjs,ts,tsx}": [

71 "oxlint --fix --no-error-on-unmatched-pattern",

72 "oxfmt --write"

73 ],

74 "*.{json,yml,yaml}": [

75 "oxfmt --write"

76 ]

77 },

78 "engines": {

79 "node": ">=20"

80 },

81 "scripts": {

82 "preinstall": "node .check-workspace.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

83 "build": "bun scripts/build.ts",

84 "typecheck": "tsgo --noEmit && tsgo --noEmit -p viewer",

85 "lint": "oxlint .",

86 "lint:fix": "oxlint --fix .",

87 "format": "pnpm exec oxfmt --write .",

88 "format:check": "pnpm exec oxfmt --check .",

89 "test": "bun test src",

90 "test:watch": "bun test --watch src"

91 }

92}

studio/server/agent/claude.tsView file

Lines 1-31typescript

1/**

2 * agent/claude.ts — the Claude Code harness. Drives a LOCAL `claude` install in

3 * headless streaming mode (no cloud API key of ours — it uses the user's own

4 * Claude Code auth). One invocation = one turn; `--resume <sessionId>` threads

5 * the conversation across turns so the agent remembers prior comments.

6 *

7 * claude -p --output-format stream-json --verbose

8 * --permission-mode <mode> [--resume <sid>] [--mcp-config <file>]

9 * [--append-system-prompt <proto>]

10 * (the turn prompt is piped on stdin so it is never argv-length-bounded)

src/commands/studio.tsView file

Lines 83-123typescript

83 }

84 throw new Error(

85 'Domain Studio requires Bun on PATH. Install it from https://bun.sh, then re-run `astrale studio`.',

86 )

87}

89/** Poll a URL until it answers (any HTTP response = up) or the deadline passes. */

90async function

viewer/dist/main.jsView file

1var $I=Object.defineProperty;var JI=($)=>$;function vI($,J){this[$]=JI.bind(null,J)}var o4=($,J)=>{for(var Q in J)$I($,Q,{get:J[Q],enumerable:!0,configurable:!0,set:vI.bind(J,Q)})}... L2: `)}var j1=($)=>(J,Q,X,v)=>{let W=X?{...X,async:!1}:{async:!1},Y=J._zod.run({value:Q,issues:[]},W);if(Y instanceof Promise)throw new E4;if(Y.issues.length){let V=new(v?.Err??$)(Y.is...

Low

Eval

Package source references a known benign dynamic code generation pattern.

viewer/dist/main.jsView on unpkg · L1

studio/server/introspect/core-extractor.tsView file

Lines 55-95typescript

55 }

56 return null

57}

59/** Build def→className from the schema's own classes/interfaces + imported schemas. */

60function classNameMap(schema: AnyRec): Map<

studio/server/view-dev-server.tsView file

Lines 130-170typescript

130

131 async stop(root: string): Promise<void> {

132 const key = resolve(root)

133 const running = this.servers.get(key)

134 if (running

src/lib/idp.tsView file

Lines 190-230typescript

190 organization_id?: string

191 authentication_method?: string

192 error?: string

193 error_description?: string

194 [key: string]: unknown

195}

196

197export type

studio/client/dist/assets/index-CyN5G8IA.jsView file

•path = studio/client/dist/assets/index-CyN5G8IA.js kind = oversized_source_file sizeBytes = 2499950 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

studio/client/dist/assets/index-CyN5G8IA.jsView on unpkg

dist/astrale.jsView file

•path = dist/astrale.js kind = oversized_cli_entrypoint sizeBytes = 2613030 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/astrale.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node .check-workspace.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

studio/server/agent/claude.tsView file

11*/ L12: import { spawn } from 'node:child_process' L13: import { existsSync, readdirSync, readFileSync } from 'node:fs'

High

Child Process

Package source references child process execution.

studio/server/agent/claude.tsView on unpkg · L11

src/commands/studio.tsView file

103function openBrowser(url: string): void { L104: // win32: `start` is a cmd.exe builtin, not a PATH executable — must go through L105: // `cmd /c start "" <url>` (the empty "" is the title arg `start` consumes).

Findings

6 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processstudio/server/agent/claude.ts

HighShellsrc/commands/studio.ts

HighSame File Env Network Executionstudio/server/view-dev-server.ts

HighCredential Exfiltrationsrc/lib/idp.ts

HighOversized Source Filestudio/client/dist/assets/index-CyN5G8IA.js

MediumDynamic Requirestudio/server/introspect/core-extractor.ts

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/astrale.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

Low

Affected versions and remediation

This report applies to @astrale-os/cli@0.6.3-alpha.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @astrale-os/cli@0.6.3-alpha.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-16 11:35:28.082Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

1.0.0-npm-deprecated.0latestClean—AllowPublishedAug 27, 2026, 3:55 PM 0.8.1-alpha.7SuspiciousAI-agent capability abuseWarnPublishedAug 20, 2026, 5:17 PM 0.8.1-alpha.5SuspiciousAI-agent capability abuseWarnPublishedAug 19, 2026, 9:38 PM 0.8.1-alpha.4SuspiciousAI-agent capability abuseWarnPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Related packages

Other data exfiltration packages

Source & flagged code