@autter/cli: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@autter/cli: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/autter.jsView file

9const fs = require('node:fs'); L10: const { spawnSync } = require('node:child_process'); L11: const { binaryDest, ensureBinary } = require('../install.js');

High

Child Process

Package source references child process execution.

bin/autter.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = @autter/cli@1.7.5 matchedPath = bin/autter.js matchedIdentity = npm:QGF1dHRlci9jbGk:1.7.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/autter.jsView on unpkg

install.jsView file

171try { L172: const out = execFileSync(bin, ['--version'], { encoding: 'utf8', timeout: 10_000 }); L173: return out.trim().split(/\s+/)[0] || null; ... L179: function reportInstallPing(tag) { L180: if (process.env.AUTTER_NO_INSTALL_PING === '1') return Promise.resolve(); L181: const safeTag = String(tag).replace(/[^A-Za-z0-9._-]/g, ''); ... L185: ); L186: return fetch(`${INSTALL_PING_HOST}/capture/`, { L187: method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L171

7// the official release binary for the current platform into ~/.autter/bin -- L8: // the same location the curl/PowerShell installers use and the location the L9: // autter daemon self-upgrades in place. Keeping one canonical binary path ... L28: L29: const pkg = require('./package.json'); L30: ... L34: const INSTALL_PING_API_KEY = 'phc_aWveMd1bPhuEYtFnCS1G2IHgln3iGQqjfIdkfnuolxI'; L35: const INSTALL_PING_HOST = 'https://us.i.posthog.com'; L36: ... L40: function assetName() { L41: const osName = OS_NAMES[process.platform]; L42: const cpuName = CPU_NAMES[process.arch];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L7

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 14-52json

14 "ai",

15 "git",

16 "authorship",

17 "attribution",

18 "blame",

19 "coding-agents",

20 "claude",

21 "copilot",

22 "cursor",

23 "codex"

24 ],

25 "bin": {

26 "autter": "bin/autter.js"

27 },

28 "files": [

29 "bin/autter.js",

30 "install.js",

31 "README.md"

32 ],

33 "scripts": {

34 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "engines": {

37 "node": ">=18"

38 },

39 "os": [

40 "darwin",

41 "linux",

42 "win32"

43 ],

44 "cpu": [

45 "x64",

46 "arm64"

47 ],

48 "publishConfig": {

49 "access": "public"

50 }

51}

52

bin/autter.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

3

4// Launcher for the native autter binary at ~/.autter/bin. The fast path is a

5// single existence check; the download in install.js only runs when the

6// postinstall was skipped (--ignore-scripts, offline CI) or the binary was

7// removed.

8

9const fs = require(

install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3

4// npm bootstrapper for the autter CLI.

5//

6// npm distributes a thin launcher, not the binary itself: this script fetches

7// the official release binary for the current platform into ~/.autter/bin --

8// the same location the curl/PowerShell installers use and the location the

9// autter daemon self-upgrades in place. Keeping one canonical binary path

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg