Loading npm security reports…

@autter/cli@1.7.5: AI-agent control-surface risk | LPM Firewall

registry / @autter/cli / 1.7.5

@autter/cli@1.7.5

Git-native AI authorship tracking: records which lines were written by AI agents and links them to the agent, model, and prompt. This package is a thin bootstrapper that installs the native autter binary.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically retrieves and executes a remote native binary, then asks it to install IDE and AI-agent hooks. The hook targets and modifications are not present in the package source.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

An uninspected executable can modify third-party IDE or AI-agent control surfaces without an explicit user command.

Mechanism

Remote binary bootstrap followed by automatic agent and editor hook setup

Policy narrative

When npm installs the package, its postinstall hook downloads a platform-specific executable to ~/.autter/bin and runs it. The installer then invokes that executable with install-hooks automatically. Since the executable and the hook targets are not included in the package, the package provides no source-visible bound on changes to IDE or AI-agent integration settings. This is an unconsented lifecycle mutation of a foreign control surface.

AI rationale

The package performs a remote executable bootstrap during postinstall and automatically executes an opaque hook installer for AI-agent and editor integrations. That creates an unconsented, uninspectable AI-agent control-surface mutation path.

Evidence

package.jsoninstall.js~/.autter/bin/autter~/.autter/bin/autter.tmp.<pid>

Network endpoints1

github.com

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/autter.jsView file

9const fs = require('node:fs'); L10: const { spawnSync } = require('node:child_process'); L11: const { binaryDest, ensureBinary } = require('../install.js');

High

Child Process

Package source references child process execution.

bin/autter.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = @autter/cli@1.7.2 matchedPath = bin/autter.js matchedIdentity = npm:QGF1dHRlci9jbGk:1.7.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/autter.jsView on unpkg

install.jsView file

157try { L158: const out = execFileSync(bin, ['--version'], { encoding: 'utf8', timeout: 10_000 }); L159: return out.trim().split(/\s+/)[0] || null; ... L165: function reportInstallPing(tag) { L166: if (process.env.AUTTER_NO_INSTALL_PING === '1') return Promise.resolve(); L167: const safeTag = String(tag).replace(/[^A-Za-z0-9._-]/g, ''); ... L171: ); L172: return fetch(`${INSTALL_PING_HOST}/capture/`, { L173: method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

install.jsView on unpkg · L157

7// the official release binary for the current platform into ~/.autter/bin -- L8: // the same location the curl/PowerShell installers use and the location the L9: // autter daemon self-upgrades in place. Keeping one canonical binary path ... L28: L29: const pkg = require('./package.json'); L30: ... L34: const INSTALL_PING_API_KEY = 'phc_aWveMd1bPhuEYtFnCS1G2IHgln3iGQqjfIdkfnuolxI'; L35: const INSTALL_PING_HOST = 'https://us.i.posthog.com'; L36: ... L40: function assetName() { L41: const osName = OS_NAMES[process.platform]; L42: const cpuName = CPU_NAMES[process.arch];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @autter/cli@1.7.2 matchedPath = install.js matchedIdentity = npm:QGF1dHRlci9jbGk:1.7.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 14-52json

14 "ai",

15 "git",

16 "authorship",

17 "attribution",

18 "blame",

19 "coding-agents",

20 "claude",

21 "copilot",

22 "cursor",

23 "codex"

24 ],

25 "bin": {

26 "autter": "bin/autter.js"

27 },

28 "files": [

29 "bin/autter.js",

30 "install.js",

31 "README.md"

32 ],

33 "scripts": {

34 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "engines": {

37 "node": ">=18"

38 },

39 "os": [

40 "darwin",

41 "linux",

42 "win32"

43 ],

44 "cpu": [

45 "x64",

46 "arm64"

47 ],

48 "publishConfig": {

49 "access": "public"

50 }

51}

52

bin/autter.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

3

4// Launcher for the native autter binary at ~/.autter/bin. The fast path is a

5// single existence check; the download in install.js only runs when the

6// postinstall was skipped (--ignore-scripts, offline CI) or the binary was

7// removed.

8

9const fs = require(

install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3

4// npm bootstrapper for the autter CLI.

5//

6// npm distributes a thin launcher, not the binary itself: this script fetches

7// the official release binary for the current platform into ~/.autter/bin --

8// the same location the curl/PowerShell installers use and the location the

9// autter daemon self-upgrades in place. Keeping one canonical binary path

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg