@atlashub/smartstack-cli@5.26.0
SmartStack Claude Code automation toolkit - GitFlow, EF Core migrations, prompts and more
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe source establishes a deliberate bypass of the package's manual Git approval hook, with default staging of the working tree, so the package should be blocked. The credential alert resolves to the intended Anthropic usage endpoint.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the bundled development workflow and a phase passes.
Impact
Changes can be committed without the hook's manual approval path. The helper refuses main and master and does not push by default.
Mechanism
The skill tells the agent to use a Git CLI that launches Git through a child process, which the Bash-only hook cannot inspect.
Attack narrative
The package includes a Git hook that blocks shell-issued writes pending manual approval, then directs its development agent workflow to commit through a child-process CLI specifically because the hook will not see that call. The helper stages all changes by default, so unrelated working-tree changes can enter local commits. The helper's branch restriction and no-push default limit the impact, but do not restore the bypassed approval.
AI rationale
The source establishes a deliberate bypass of the package's manual Git approval hook, with default staging of the working tree, so the package should be blocked. The credential alert resolves to the intended Anthropic usage endpoint.
Evidence
templates/skills/ba-develop/SKILL.mdtemplates/skills/ba-develop/references/commit-checkpoints.mdtemplates/hooks/git-guard.cjstemplates/skills/gitflow/cli/commit/execute.tstemplates/skills/gitflow/cli/lib/git.tsdist/index.js
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The development skill directs the agent to commit after each passing phase through the CLI, and its companion instructions explicitly say this bypasses the manual Bash hook by design.
- The installed Git hook blocks Git write commands issued through Claude Code's Bash tool.
- The commit helper stages the whole working tree by default and runs Git through a child process; it blocks commits on main and master, and pushes only when requested.
- The CLI registers the Git hook as a guard against unapproved Git writes.
- The statusline sends Claude Code's saved OAuth token to Anthropic's usage endpoint for quota data, with an expiry check and background refresh.
Evidence against
- The Git helper prevents commits on main and master and does not push unless the caller requests it.
- The statusline credential transfer is directed to api.anthropic.com's OAuth usage endpoint, not an unrelated recipient.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
39* Constructs the CommanderError class
L40: * @param {number} exitCode suggested exit code which could be used with process.exit
L41: * @param {string} code an id string representing the error
...
L970: var EventEmitter2 = require("events").EventEmitter;
L971: var childProcess = require("child_process");
L972: var path3 = require("path");
...
L1019: this._outputConfiguration = {
L1020: writeOut: (str) => process11.stdout.write(str),
L1021: writeErr: (str) => process11.stderr.write(str),
...
L1055: * @returns {Command[]}
L1056: * @private
L1057: */
Findings
2 Critical8 High5 Medium5 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighRuntime Package Installdist/index.js
HighSemantic Analysis Limitedtemplates/hooks/git-guard.cjs#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
Medium
Affected versions and remediation
This report applies to @atlashub/smartstack-cli@5.26.0.
See all versions of @atlashub/smartstack-cli for other recorded verdicts.
- Avoid installing @atlashub/smartstack-cli@5.26.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.