Loading npm security reports…

@autter/cli@1.7.2: AI-agent control-surface risk | LPM Firewall

registry / @autter/cli / 1.7.2

@autter/cli@1.7.2

Git-native AI authorship tracking: records which lines were written by AI agents and links them to the agent, model, and prompt. This package is a thin bootstrapper that installs the native autter binary.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation downloads and executes an external native binary. That binary is automatically told to install IDE and AI-agent hooks.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Can alter AI-agent or editor integrations without a separate user command; the downloaded binary is outside this source review.

Mechanism

Downloads, executes, and delegates hook installation to an opaque binary.

Policy narrative

Installing the package runs a postinstall hook. It downloads a native executable into ~/.autter/bin, executes it, and invokes install-hooks to configure IDE and agent integrations; source states the daemon rechecks those hooks daily. Because hook behavior resides in the downloaded binary and is activated without an explicit setup command, this is unconsented install-time AI-agent control-surface mutation.

AI rationale

The package creates a concrete automatic chain from npm postinstall to an externally fetched executable that installs agent/editor hooks. This meets the install-control-surface blocking policy despite checksum verification and telemetry disclosure.

Evidence

package.jsoninstall.js~/.autter/bin/autter

Network endpoints2

github.com/autter-dev/autter-cli/releases/download/us.i.posthog.com/capture/

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/autter.jsView file

9const fs = require('node:fs'); L10: const { spawnSync } = require('node:child_process'); L11: const { binaryDest, ensureBinary } = require('../install.js');

High

Child Process

Package source references child process execution.

bin/autter.jsView on unpkg · L9

install.jsView file

157try { L158: const out = execFileSync(bin, ['--version'], { encoding: 'utf8', timeout: 10_000 }); L159: return out.trim().split(/\s+/)[0] || null; ... L165: function reportInstallPing(tag) { L166: if (process.env.AUTTER_NO_INSTALL_PING === '1') return Promise.resolve(); L167: const safeTag = String(tag).replace(/[^A-Za-z0-9._-]/g, ''); ... L171: ); L172: return fetch(`${INSTALL_PING_HOST}/capture/`, { L173: method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L157

7// the official release binary for the current platform into ~/.autter/bin -- L8: // the same location the curl/PowerShell installers use and the location the L9: // autter daemon self-upgrades in place. Keeping one canonical binary path ... L28: L29: const pkg = require('./package.json'); L30: ... L34: const INSTALL_PING_API_KEY = 'phc_aWveMd1bPhuEYtFnCS1G2IHgln3iGQqjfIdkfnuolxI'; L35: const INSTALL_PING_HOST = 'https://us.i.posthog.com'; L36: ... L40: function assetName() { L41: const osName = OS_NAMES[process.platform]; L42: const cpuName = CPU_NAMES[process.arch];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L7

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 14-52json

14 "ai",

15 "git",

16 "authorship",

17 "attribution",

18 "blame",

19 "coding-agents",

20 "claude",

21 "copilot",

22 "cursor",

23 "codex"

24 ],

25 "bin": {

26 "autter": "bin/autter.js"

27 },

28 "files": [

29 "bin/autter.js",

30 "install.js",

31 "README.md"

32 ],

33 "scripts": {

34 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "engines": {

37 "node": ">=18"

38 },

39 "os": [

40 "darwin",

41 "linux",

42 "win32"

43 ],

44 "cpu": [

45 "x64",

46 "arm64"

47 ],

48 "publishConfig": {

49 "access": "public"

50 }

51}

52

bin/autter.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

3

4// Launcher for the native autter binary at ~/.autter/bin. The fast path is a

5// single existence check; the download in install.js only runs when the

6// postinstall was skipped (--ignore-scripts, offline CI) or the binary was

7// removed.

8

9const fs = require(

install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3

4// npm bootstrapper for the autter CLI.

5//

6// npm distributes a thin launcher, not the binary itself: this script fetches

7// the official release binary for the current platform into ~/.autter/bin --

8// the same location the curl/PowerShell installers use and the location the

9// autter daemon self-upgrades in place. Keeping one canonical binary path

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg