registry / @bakit-org/cli / 1.1.12

@bakit-org/cli@1.1.12

BA-kit CLI — AI-powered Business Analyst toolkit for Claude Code

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a CLI wrapper whose lifecycle hook only warns about a local PATH conflict; broader Claude Code framework installation is activated by explicit ba-kit commands.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall warning, or user-run ba-kit install/update/uninstall

Impact

Can modify ~/.claude content and hooks after explicit install; no unconsented install-time mutation observed

Mechanism

user-invoked GitHub release downloader and Claude Code framework installer

Rationale

Static inspection shows suspicious primitives are package-aligned and mostly user-invoked: the postinstall script does not alter files, while the CLI installs a documented Claude Code toolkit from GitHub after explicit commands. No credential harvesting, stealthy exfiltration, obfuscation, or unconsented lifecycle AI-agent control-surface mutation was found.

Evidence

package.jsonpostinstall.jsba-kitREADME.md~/.local/bin/ba-kit~/.claude~/.claude/settings.json~/.claude/backups~/.claude/ba-kit

Network endpoints3

github.compolar.sh/checkout/polar_c_Bd8xfL8VTBQtYpol2MdbS2M5acEFMsjKmDFec0bYVGFpolar.sh/bakit-org/products/ba-kit-solo-pro

@bakit-org/cli@1.1.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code