registry / @autter/cli / 1.6.8

@autter/cli@1.6.8

Git-native AI authorship tracking: records which lines were written by AI agents and links them to the agent, model, and prompt. This package is a thin bootstrapper that installs the native autter binary.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. At npm postinstall, the package fetches a platform binary into ~/.autter/bin and executes it with install-hooks. The downloaded binary is outside the inspected source and may alter IDE/agent integration state.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation with lifecycle scripts enabled

Impact

Unconsented first-party agent/editor extension setup and ongoing daemon-managed hook lifecycle.

Mechanism

remote native-binary bootstrap followed by automatic agent/editor hook setup

AI rationale

This is a concrete install-time agent/editor integration lifecycle risk, not evidence of malicious exfiltration or a foreign control-surface hijack. Downgrade to warn because the postinstall executes an uninspectable remote native binary and automatically configures hooks.

Evidence

package.jsoninstall.jsbin/autter.js~/.autter/bin/autter

Network endpoints2

github.com/autter-dev/autter-cli/releases/download/${tag}/${file}us.i.posthog.com/capture/

Decision evidence

public snapshot

with false-positive risk.

@autter/cli@1.6.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code