registry / @autter/cli / 2.0.3

@autter/cli@2.0.3

⚠ Under review

Git-native AI authorship tracking: records which lines were written by AI agents and links them to the agent, model, and prompt. This package is a thin bootstrapper that installs the native autter binary.

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 11.2 KB of source, external domains: api.autter.dev, github.com, us.i.posthog.com

Source & flagged code

8 flagged

package.jsonView file

Lines 14-52json

14 "ai",

15 "git",

16 "authorship",

17 "attribution",

18 "blame",

19 "coding-agents",

20 "claude",

21 "copilot",

22 "cursor",

23 "codex"

24 ],

25 "bin": {

26 "autter": "bin/autter.js"

27 },

28 "files": [

29 "bin/autter.js",

30 "install.js",

31 "README.md"

32 ],

33 "scripts": {

34 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 },

36 "engines": {

37 "node": ">=18"

38 },

39 "os": [

40 "darwin",

41 "linux",

42 "win32"

43 ],

44 "cpu": [

45 "x64",

46 "arm64"

47 ],

48 "publishConfig": {

49 "access": "public"

50 }

51}

bin/autter.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2'use strict';

4// Launcher for the native autter binary at ~/.autter/bin. The fast path is a

5// single existence check; the download in install.js only runs when the

6// postinstall was skipped (--ignore-scripts, offline CI) or the binary was

7// removed.

9const fs = require(

install.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4// npm bootstrapper for the autter CLI.

5//

6// npm distributes a thin launcher, not the binary itself: this script fetches

7// the official release binary for the current platform into ~/.autter/bin --

8// the same location the curl/PowerShell installers use and the location the

9// autter daemon self-upgrades in place. Keeping one canonical binary path

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

install.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

@autter/cli@2.0.3

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code