registry / @atlashub/smartstack-cli / 5.19.0
@atlashub/smartstack-cli@5.19.0
SmartStack Claude Code automation toolkit - GitFlow, EF Core migrations, prompts and more
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real user-invoked AI-agent extension installation surface and vendor license telemetry, but source inspection found no automatic install-time mutation or credential exfiltration. This is a first-party extension lifecycle risk rather than concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running ss install or license activation and validation commands.
Impact
It can change the user's Claude configuration and send licensing data to the vendor.
Mechanism
User-invoked Claude extension installation and license telemetry.
AI rationale
The package has a real user-invoked AI-agent extension installation surface and vendor license telemetry, but source inspection found no automatic install-time mutation or credential exfiltration. This is a first-party extension lifecycle risk rather than concrete malicious behavior.
Evidence
dist/index.js~/.claude/settings.json~/.claude/skills~/.claude/agents~/.claude/hooks~/.claude/commands
Network endpoints1
license.atlashub.ch
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit ss install command defaults to deploying commands, agents, and hooks into the user's Claude directory.
- The installer reads and rewrites the user's Claude settings file, making a timestamped backup first.
- License operations send a configured API key and a machine fingerprint to the vendor's license service.
Evidence against
- The postinstall hook only prints a Windows PATH hint and does not install templates, alter settings, or make network requests.
- Claude-directory mutation is behind an explicit CLI install command, not the npm lifecycle hook.
- No evidence of secret harvesting beyond the package's own configured license key was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
39* Constructs the CommanderError class
L40: * @param {number} exitCode suggested exit code which could be used with process.exit
L41: * @param {string} code an id string representing the error
...
L970: var EventEmitter2 = require("events").EventEmitter;
L971: var childProcess = require("child_process");
L972: var path3 = require("path");
...
L1019: this._outputConfiguration = {
L1020: writeOut: (str) => process11.stdout.write(str),
L1021: writeErr: (str) => process11.stderr.write(str),
...
L1055: * @returns {Command[]}
L1056: * @private
L1057: */
Findings
3 Critical9 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltatemplates/scripts/statusline/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelltemplates/skills/uat/cli/uat-run/execute.ts
HighSame File Env Network Executiontemplates/scripts/statusline/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
Affected versions and remediation
This report applies to @atlashub/smartstack-cli@5.19.0.
See all versions of @atlashub/smartstack-cli for other recorded verdicts.
- Review the evidence and your use of @atlashub/smartstack-cli@5.19.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.