registry / AI-agent control-surface risk / @azad-73/cli
@azad-73/cli
Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
Azad73 — agentic AI platform CLI (branded TUI + agents) built on the Pi SDK
This report shows the evidence for @azad-73/cli@0.4.4. 2 of 4 known versions are blocked or flagged. The newest version, 0.4.7, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe confirmed lifecycle script performs broad writes into a foreign AI-agent SDK, including persistent configuration takeover. Package-aligned runtime channel and workflow features do not negate this install-time control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall during package installation
Impact
Changes a foreign AI coding-agent control surface without user action; may redirect its persistent state to ~/.azad and alter its runtime behavior.
Mechanism
dependency mutation and AI-agent configuration takeover
Policy narrative
On install, the postinstall script locates a separately published Pi coding-agent package, rewrites its package configuration to use Azad's name and persistent directory, and patches interactive SDK files. This occurs without invoking the azad command or obtaining consent, altering a foreign AI-agent control surface shared through dependency resolution.
AI rationale
The confirmed lifecycle script performs broad writes into a foreign AI-agent SDK, including persistent configuration takeover. Package-aligned runtime channel and workflow features do not negate this install-time control-surface mutation.
Evidence
package.jsonapply-brand.mjsdist/azad.jsnode_modules/@earendil-works/pi-coding-agent/package.jsonnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/theme/theme.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/*.jsnode_modules/@earendil-works/pi-tui/dist/components/select-list.js
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json defines unconsented postinstall: node apply-brand.mjs.
- apply-brand.mjs resolves and rewrites @earendil-works/pi-coding-agent/package.json.
- Postinstall changes the foreign SDK piConfig name and configDir to azad/.azad.
- Postinstall sweeps foreign SDK interactive component JS files and rewrites UI literals.
Evidence against
- No network, credential reading, or command execution appears in apply-brand.mjs.
- Runtime network sends are tied to user-configured messaging/webhook features.
- CLI command execution is an explicit agent/workflow capability, not install-time behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node apply-brand.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/azad.jsView file
57for (var i = 0; i < this.data.length; i++) {
L58: buffer.put(this.data.charCodeAt(i), 8);
L59: }
...
L708: QRCode.prototype = {
L709: addData: function(data) {
L710: var newData = new QR8bitByte(data);
...
L1102: // src/azad.ts
L1103: import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
L1104: import fs20 from "node:fs";
...
L1134: function resolveConfig() {
L1135: const debugEnv = (process.env.AZAD_DEBUG ?? "").trim();
L1136: const logEnv = (process.env.AZAD_LOG ?? "").trim().toLowerCase();
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
dist/azad.jsView on unpkg · L5757Trigger-reachable chain: manifest.bin -> dist/azad.js
L57: for (var i = 0; i < this.data.length; i++) {
L58: buffer.put(this.data.charCodeAt(i), 8);
L59: }
...
L708: QRCode.prototype = {
L709: addData: function(data) {
L710: var newData = new QR8bitByte(data);
...
L1102: // src/azad.ts
L1103: import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
L1104: import fs20 from "node:fs";
...
L1134: function resolveConfig() {
L1135: const debugEnv = (process.env.AZAD_DEBUG ?? "").trim();
L1136: const logEnv = (process.env.AZAD_LOG ?? "").trim().toLowerCase();
Findings
2 Critical3 High3 Medium6 Low
CriticalCommand Output Exfiltrationdist/azad.js
CriticalTrigger Reachable Dangerous Capabilitydist/azad.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/azad.js
HighShell
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @azad-73/cli@0.4.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @azad-73/cli@0.4.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
4 known versions0.4.7latestSuspiciousAgent extension lifecycle riskWarnPublishedJul 4, 2026, 8:35 PM0.4.4shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 3, 2026, 9:44 AM0.4.3Suspicious—WarnPublishedJul 1, 2026, 10:35 AM0.4.2MaliciousSoft block: AI-agent control surfaceBlockPublishedJun 30, 2026, 10:59 AM