registry / @atlashub/smartstack-cli / 5.10.0
@atlashub/smartstack-cli@5.10.0
SmartStack Claude Code automation toolkit - GitFlow, EF Core migrations, prompts and more
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's exfiltration label overstates the observed flow: the token is sent to Anthropic's API rather than an unrelated endpoint. However, explicit installation creates a persistent Claude integration that reads credentials, so it warrants a warning under the extension-lifecycle policy.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `smartstack install`/`ss install`, then Claude Code invokes the configured statusline.
Impact
A package-installed persistent Claude statusline gains access to the local Claude OAuth token and makes authenticated requests to Anthropic.
Mechanism
First-party Claude extension setup with OAuth-token-backed usage polling.
AI rationale
The scanner's exfiltration label overstates the observed flow: the token is sent to Anthropic's API rather than an unrelated endpoint. However, explicit installation creates a persistent Claude integration that reads credentials, so it warrants a warning under the extension-lifecycle policy.
Evidence
package.jsonscripts/postinstall.jsdist/index.jstemplates/scripts/statusline/index.js~/.claude/.credentials.json~/.claude/settings.json~/.claude/scripts/statusline/index.js~/.claude/cache/smartstack-usage.json
Network endpoints1
api.anthropic.com/api/oauth/usage
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `ss install` deploys templates into `~/.claude` or `./.claude`.
- Install registers a recurring Claude `statusLine` command and PreToolUse hooks.
- The deployed statusline reads `~/.claude/.credentials.json` accessToken.
- It sends that bearer token to `api.anthropic.com/api/oauth/usage`.
- The npm postinstall only prints a Windows PATH hint.
Evidence against
- Credential use is limited to Anthropic's documented-looking usage endpoint, not a package-controlled host.
- Statusline deployment and config mutation require explicit `ss install`; no lifecycle path reaches it.
- Installer preserves a foreign status line unless `--force` is supplied.
- No hidden payload download, eval, or unrelated credential receiver was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
16 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination.
dist/index.js:
`choices: ${option.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}`
`default: ${option.defaultValueDescription || JSON.stringify(option.defaultValue)}`
extraInfo.push(`preset: ${JSON.stringify(option.presetArg)}`);
`choices: ${argument.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}`
`default: ${argument.defaultValueDescription || JSON.stringify(argument.defaultValue)}`
writeOut: (str) => process11.stdout.write(str),
writeErr: (str) => process11.stderr.write(str),
* Call with no parameters to parse `process.argv`. Detects Electron and special node options like `node --eval`. Easy mode!
Findings
5 Critical7 High7 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalCredential Exfiltrationdist/index.js
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltatemplates/scripts/statusline/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelltemplates/skills/uat/cli/uat-run/execute.ts
HighSame File Env Network Executiontemplates/scripts/statusline/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
Affected versions and remediation
This report applies to @atlashub/smartstack-cli@5.10.0.
See all versions of @atlashub/smartstack-cli for other recorded verdicts.
- Review the evidence and your use of @atlashub/smartstack-cli@5.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.