registry / AI-agent control-surface risk / @aziron/atlas
@aziron/atlas
Atlas local code-intelligence CLI. Installs the native atlas binary and uses embedded SQLite by default.
This report shows the evidence for @aziron/atlas@0.1.36. 1 of 7 known versions is blocked or flagged. The newest version, 0.1.53, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, unconsented postinstall execution that mutates AI-assistant configuration according to the installer's own comments. Documentation and opt-out controls do not remove the install-time control-surface risk.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install of @aziron/atlas@0.1.36
Impact
Unconsented postinstall mutation of an AI-agent control surface; the downloaded binary controls the exact writes.
Mechanism
remote native-binary download followed by automatic AI-assistant bootstrap
Policy narrative
On installation, scripts/install.js fetches a platform archive, extracts the native atlas executable, and runs `atlas bootstrap`. The source explicitly says bootstrap automatically installs a skill and MCP configuration for AI assistants. Because this is an opaque downloaded binary run without user invocation during postinstall, its control-surface changes cannot be constrained by the package source.
AI rationale
This is concrete, unconsented postinstall execution that mutates AI-assistant configuration according to the installer's own comments. Documentation and opt-out controls do not remove the install-time control-surface risk.
Evidence
package.jsonscripts/install.jsbin/atlas.jsREADME.mdvendor/<platform>-<arch>/atlas<temporary directory>/atlas_0.1.36_<os>_<arch>.tar.gz
Network endpoints1
github.com/aziron-ai/atlas/releases/download/v0.1.36
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- scripts/install.js postinstall downloads a release archive and executes its native binary.
- scripts/install.js runs `atlas bootstrap` automatically during npm postinstall.
- Installer states bootstrap writes skill and MCP configuration for AI assistants.
- ATLAS_DOWNLOAD_BASE_URL can replace the binary-download origin.
Evidence against
- Default download host is package-aligned github.com/aziron-ai/atlas releases.
- Bootstrap is documented, best-effort, and can be disabled with ATLAS_SKIP_BOOTSTRAP.
- No credential harvesting or exfiltration is present in the JavaScript source.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @aziron/atlas@0.1.36.
The versions list below shows the verdict for each recorded version.
- Avoid installing @aziron/atlas@0.1.36. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
7 known versions0.1.53latestSuspiciousAgent extension lifecycle riskWarnPublishedAug 11, 2026, 2:49 PM0.1.51Suspicious—WarnPublishedAug 5, 2026, 10:51 AM0.1.46Suspicious—WarnPublishedJul 23, 2026, 12:32 PM0.1.42Suspicious—WarnPublishedJul 21, 2026, 11:21 PM0.1.36shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJul 19, 2026, 2:16 PM0.1.35SuspiciousAgent extension lifecycle riskWarnPublishedJul 15, 2026, 7:18 PM0.1.27SuspiciousStaged Payload CarrierWarnPublishedJul 1, 2026, 5:04 AM