registry / @aui.io/apollo / 0.1.39
@aui.io/apollo@0.1.39
Apollo operator console — CLI + interactive TUI
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe postinstall actions are transparent and tied to Apollo’s dependency repair and shell integration, with guards and a visible opt-out. The required source paths show package-aligned CLI, API, diagnostic, and TUI behavior; scanner similarity hints alone do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm install runs the declared postinstall script.
Impact
The setup may modify the user’s shell startup files to enable Apollo workspace auto-cd; inspected source does not establish credential theft, unrelated exfiltration, or broad agent control-surface mutation.
Mechanism
The repair script conditionally replaces a broken package-local OpenTUI directory and installs the package’s declared OpenTUI dependencies. Shell setup conditionally appends an Apollo shell integration line to eligible startup files, with CI and opt-out guards.
AI rationale
The postinstall actions are transparent and tied to Apollo’s dependency repair and shell integration, with guards and a visible opt-out. The required source paths show package-aligned CLI, API, diagnostic, and TUI behavior; scanner similarity hints alone do not establish malicious behavior.
Evidence
scripts/ensure-opentui.mjsscripts/setup-shell.mjs
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a postinstall that runs OpenTUI repair and shell setup; the package entrypoint delegates to its CLI.
- OpenTUI repair targets the package’s own dependency directory and installs only its declared OpenTUI dependencies when repair is needed.
- Shell setup skips CI or an opt-out flag, and adds a guarded Apollo shell integration line to applicable shell startup files.
- The doctor describes its checks as read-only; IDE launching is limited to known local editors.
- Identity and management clients call service API paths through their configured HTTP client; inspected excerpts show no unrelated recipient.
- Inspected bundled files expose ordinary YAML parsing, Commander command setup, npm upgrade support, and a file-tool-limited Claude adapter.
Evidence against
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemShell
Source & flagged code
15 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/apollo.jsView file
10L11: const require = createRequire(import.meta.url);
L12: const cliBin = require.resolve("@aui.io/apollo-cli/bin/apollo.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/apollo.jsView on unpkg · L10Findings
12 High5 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitednode_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/services/doctor.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/dist/src/lib/ide.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/api/identity.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/node_modules/@opentui/core/chunk-bun-t2myhmwd.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/services/upgrade.js
Affected versions and remediation
This report applies to @aui.io/apollo@0.1.39.
See all versions of @aui.io/apollo for other recorded verdicts.
- Review the evidence and your use of @aui.io/apollo@0.1.39 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.