@aui.io/apollo@0.1.35
Apollo operator console — CLI + interactive TUI
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe postinstall hook persistently modifies shell startup files, so this merits a warning. Inspected behavior ties the wrapper to Apollo's agent commands and does not establish credential theft, remote execution, or agent-control hijacking.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package runs postinstall; the shell wrapper takes effect when a configured shell starts.
Impact
Shell startup is modified, and later successful agent use, import, or create commands can change the current shell's directory.
Mechanism
The setup script appends a guarded eval line to existing zsh or bash startup files and may create the detected login shell's startup file.
AI rationale
The postinstall hook persistently modifies shell startup files, so this merits a warning. Inspected behavior ties the wrapper to Apollo's agent commands and does not establish credential theft, remote execution, or agent-control hijacking.
Evidence
package.jsonscripts/setup-shell.mjsnode_modules/@aui.io/apollo-cli/dist/src/commands/shell.js~/.zshrc~/.bashrc~/.bash_profile
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook runs both the OpenTUI repair and shell setup scripts.
- Shell setup appends an Apollo integration line to selected shell startup files.
- The integration wraps the Apollo command and can change directories after successful agent use, import, or create commands.
- If bundled OpenTUI directories are incomplete, the repair script runs npm install for the package's declared OpenTUI dependencies.
Evidence against
- The shell wrapper changes directories only after the user runs a successful Apollo agent command.
- The inspected install scripts show no credential collection, external endpoint, or AI-agent configuration writes.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
NoLicense
Source & flagged code
14 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/apollo.jsView file
10L11: const require = createRequire(import.meta.url);
L12: const cliBin = require.resolve("@aui.io/apollo-cli/bin/apollo.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/apollo.jsView on unpkg · L10Findings
11 High5 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitednode_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/services/doctor.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/dist/src/lib/ide.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/api/identity.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/node_modules/@opentui/core/chunk-bun-t2myhmwd.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/services/upgrade.js
Affected versions and remediation
This report applies to @aui.io/apollo@0.1.35.
See all versions of @aui.io/apollo for other recorded verdicts.
- Review the evidence and your use of @aui.io/apollo@0.1.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.