@aui.io/apollo@0.1.86
Apollo CLI — author, test and operate Apollo-1 agents from your terminal (scriptable CLI + interactive TUI)
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe default postinstall can modify user shell startup files and create a persistent hook, so a warning is warranted. The inspected changes are limited to Apollo shell integration and do not establish a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package with its postinstall lifecycle enabled, outside CI and without APOLLO_NO_SHELL_SETUP=1.
Impact
Future eligible shells invoke the Apollo shell integration; the inspected code does not establish a broader control-surface change or credential exposure.
Mechanism
The setup script appends a guarded command that checks for apollo and evaluates its shell-init output in eligible zsh/bash startup files.
AI rationale
The default postinstall can modify user shell startup files and create a persistent hook, so a warning is warranted. The inspected changes are limited to Apollo shell integration and do not establish a concrete malicious chain.
Evidence
package.jsonscripts/setup-shell.mjs~/.zshrc~/.bashrc~/.bash_profile
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package postinstall automatically runs shell setup.
- Shell setup appends an Apollo shell-init eval line to existing zsh/bash startup files, unless CI or APOLLO_NO_SHELL_SETUP=1 is set.
- The startup hook runs the Apollo shell integration in future shells; this creates persistence, though it is limited to shell startup files and is described as auto-cd integration.
Evidence against
- The other postinstall helper only repairs missing OpenTUI dependencies, using package-declared dependency versions.
- Inspected identity client calls send OTP and login requests through its HTTP client; no unrelated recipient is shown.
- The flagged IDE launcher starts the selected editor for the checkout directory.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
NoLicense
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/apollo.jsView file
10L11: const require = createRequire(import.meta.url);
L12: const cliBin = require.resolve("@aui.io/apollo-cli/bin/apollo.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/apollo.jsView on unpkg · L10Findings
8 High5 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitednode_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/dist/src/lib/ide.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-core/dist/src/api/identity.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/node_modules/@opentui/core/chunk-bun-t2myhmwd.js
HighKnown Malware Source Similaritynode_modules/@aui.io/apollo-tui/dist/src/author/backend/claudeCode.js
HighPrevious Version Dangerous Deltanode_modules/@aui.io/apollo-core/dist/src/services/doctor.js
Affected versions and remediation
This report applies to @aui.io/apollo@0.1.86.
See all versions of @aui.io/apollo for other recorded verdicts.
- Review the evidence and your use of @aui.io/apollo@0.1.86 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.