registry / @azad-73/cli / 0.4.2

@azad-73/cli@0.4.2

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Azad73 — agentic AI platform CLI (branded TUI + agents) built on the Pi SDK

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently mutates a separately published AI coding-agent SDK and its UI dependency. The modification changes the SDK identity and config directory for all consumers sharing that installation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Hijacks a broad installed AI-agent control surface without an explicit user command.

Mechanism

Foreign AI-agent SDK configuration and code mutation

Policy narrative

On installation, package.json invokes apply-brand.mjs. That script resolves the foreign @earendil-works/pi-coding-agent package, rewrites its piConfig to use Azad branding and ~/.azad, and patches SDK/UI distribution files. This is an unconsented postinstall mutation of a foreign AI-agent control surface, affecting the installed dependency rather than only this package's own files.

Rationale

Direct source inspection confirms an install-time rewrite of a foreign AI coding-agent package and UI dependency. This meets the blocking policy regardless of the package's stated branding purpose.

Evidence

package.jsonapply-brand.mjsdist/azad.jsREADME.mdnode_modules/@earendil-works/pi-coding-agent/package.jsonnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/theme/theme.jsnode_modules/@earendil-works/pi-tui/dist/components/select-list.js

@azad-73/cli@0.4.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code