registry / @azad-73/cli / 0.4.4

@azad-73/cli@0.4.4

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

Azad73 — agentic AI platform CLI (branded TUI + agents) built on the Pi SDK

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently mutates the installed Pi coding-agent dependency rather than only this package. It redirects that foreign agent's identity/configuration and patches multiple SDK UI files.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall during package installation

Impact

Changes a foreign AI coding-agent control surface without user action; may redirect its persistent state to ~/.azad and alter its runtime behavior.

Mechanism

dependency mutation and AI-agent configuration takeover

Policy narrative

On install, the postinstall script locates a separately published Pi coding-agent package, rewrites its package configuration to use Azad's name and persistent directory, and patches interactive SDK files. This occurs without invoking the azad command or obtaining consent, altering a foreign AI-agent control surface shared through dependency resolution.

Rationale

The confirmed lifecycle script performs broad writes into a foreign AI-agent SDK, including persistent configuration takeover. Package-aligned runtime channel and workflow features do not negate this install-time control-surface mutation.

Evidence

package.jsonapply-brand.mjsdist/azad.jsnode_modules/@earendil-works/pi-coding-agent/package.jsonnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/theme/theme.jsnode_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/*.jsnode_modules/@earendil-works/pi-tui/dist/components/select-list.js

@azad-73/cli@0.4.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code