@aziron/atlas
Atlas local code-intelligence CLI. Installs the native atlas binary and uses embedded SQLite by default.
This report shows the evidence for @aziron/atlas@0.1.36. 1 of 7 known versions is blocked or flagged. The newest version, 0.1.53, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete, unconsented postinstall execution that mutates AI-assistant configuration according to the installer's own comments. Documentation and opt-out controls do not remove the install-time control-surface risk.
Decision evidence
public snapshot- scripts/install.js postinstall downloads a release archive and executes its native binary.
- scripts/install.js runs `atlas bootstrap` automatically during npm postinstall.
- Installer states bootstrap writes skill and MCP configuration for AI assistants.
- ATLAS_DOWNLOAD_BASE_URL can replace the binary-download origin.
- Default download host is package-aligned github.com/aziron-ai/atlas releases.
- Bootstrap is documented, best-effort, and can be disabled with ATLAS_SKIP_BOOTSTRAP.
- No credential harvesting or exfiltration is present in the JavaScript source.
Source & flagged code
2 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @aziron/atlas@0.1.36.
The versions list below shows the verdict for each recorded version.
- Avoid installing @aziron/atlas@0.1.36. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.