registry / @astralkit/cli / 4.5.0

@astralkit/cli@4.5.0

AstralKit CLI — Install and manage UI components in your project

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Explicit starter-kit scaffolding accepts remote file paths without validation, then installs the generated project dependencies. A compromised API response can escape the new project directory and introduce executable package metadata.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs astralkit init <project-name>.

Impact

Arbitrary filesystem writes relative to the working directory and potential remote code execution through crafted project dependencies.

Mechanism

Unchecked remote starter-kit file write followed by automatic package-manager install.

Rationale

This is not package malware or install-time behavior, but it is a concrete critical remote-content validation flaw in a user-invoked scaffold flow.

Evidence

package.jsonsrc/commands/init.jssrc/lib/api.jssrc/lib/pkg-manager.jssrc/lib/validators.js

Network endpoints1

astralkit.com/api/cli/starter-kit

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

@astralkit/cli@4.5.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code