registry / @aui.io/apollo / 0.1.25

@aui.io/apollo@0.1.25

Apollo operator console — CLI + interactive TUI

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Installing the package runs a postinstall hook that appends a guarded `eval` line to existing zsh/bash rc files and may create the login shell rc file. Future interactive shells invoke the installed Apollo command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

Automatic startup-file modification enables later command execution under the user's shell context; no exfiltration or remote-payload chain is established.

Mechanism

postinstall shell-rc persistence and conditional npm dependency repair

Rationale

This is a real unconsented install-time persistence primitive, but it is transparent, documented, opt-out capable, and scoped to the package's own CLI. The inspected files do not establish malicious intent or a concrete payload chain.

Evidence

package.jsonscripts/setup-shell.mjsscripts/ensure-opentui.mjsbin/apollo.jsREADME.md~/.zshrc~/.bashrc~/.bash_profilenode_modules/@opentui

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

@aui.io/apollo@0.1.25

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code