registry / @atlashub/smartstack-cli / 5.21.0
@atlashub/smartstack-cli@5.21.0
SmartStack Claude Code automation toolkit - GitFlow, EF Core migrations, prompts and more
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete credential exfiltration to a package-controlled endpoint or automatic install-time agent mutation was found. The explicit installer nevertheless deploys recurring agent code that reads and uses an OAuth token, so it warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs ss install, then Claude Code runs the configured status line.
Impact
A sensitive Claude OAuth credential is available to package-deployed code and used for network requests.
Mechanism
Claude extension setup followed by OAuth-token-backed quota polling.
AI rationale
No concrete credential exfiltration to a package-controlled endpoint or automatic install-time agent mutation was found. The explicit installer nevertheless deploys recurring agent code that reads and uses an OAuth token, so it warrants a warning.
Evidence
dist/index.jstemplates/scripts/statusline/index.js~/.claude/settings.json~/.claude/scripts/statusline/index.js~/.claude/.credentials.json~/.claude/cache/smartstack-usage.json
Network endpoints1
api.anthropic.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit ss install command defaults to installing commands, agents, and hooks in the user's .claude directory.
- The installer writes a recurring command status line into Claude settings.
- That deployed status line reads the Claude OAuth access token and sends it as a bearer credential to api.anthropic.com.
- The credential-bearing network request can run in background maintenance after the extension is installed.
Evidence against
- The npm postinstall script only displays a Windows PATH message and does not install the extension.
- The agent configuration is reached through the user-invoked ss install command, not automatically during npm installation.
- The request target is api.anthropic.com, not a package-controlled third-party host.
- The status-line network activity has an environment-variable opt-out.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
39* Constructs the CommanderError class
L40: * @param {number} exitCode suggested exit code which could be used with process.exit
L41: * @param {string} code an id string representing the error
...
L970: var EventEmitter2 = require("events").EventEmitter;
L971: var childProcess = require("child_process");
L972: var path3 = require("path");
...
L1019: this._outputConfiguration = {
L1020: writeOut: (str) => process11.stdout.write(str),
L1021: writeErr: (str) => process11.stderr.write(str),
...
L1055: * @returns {Command[]}
L1056: * @private
L1057: */
Findings
3 Critical8 High6 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltatemplates/scripts/statusline/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelltemplates/skills/uat/cli/uat-run/execute.ts
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
HighSemantic Analysis Limitedscripts/generate-docs/index.ts#virtual:normalized:round1
Affected versions and remediation
This report applies to @atlashub/smartstack-cli@5.21.0.
See all versions of @atlashub/smartstack-cli for other recorded verdicts.
- Review the evidence and your use of @atlashub/smartstack-cli@5.21.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.