registry / @bakit-org/cli / 1.2.0

@bakit-org/cli@1.2.0

BA-kit CLI — AI-powered Business Analyst toolkit for Claude Code

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface; package is a CLI wrapper/installer for BA-kit content. Risky operations are user-invoked installer behavior plus a scoped postinstall cleanup of stale BA-kit binaries.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall cleanup; user runs ba-kit install/update/uninstall for runtime changes.

Impact

Can modify ~/.claude, ~/.codex, ~/.gemini/config BA-kit-owned paths and Claude hooks when explicitly installed; postinstall can remove stale BA-kit files in ~/.local/bin.

Mechanism

scoped file cleanup and user-invoked AI-agent toolkit installation

Rationale

Static inspection shows a package-aligned installer with a lifecycle cleanup script, not stealth exfiltration or unconsented agent control-surface mutation. The agent/runtime modifications are documented and require explicit ba-kit commands after installation.

Evidence

package.jsonpostinstall.jsba-kitREADME.md~/.local/bin/ba-kit~/.local/bin/ba-kit.cmd~/.local/bin/ba-kit.ps1~/.claude~/.codex~/.gemini/config~/.claude/settings.json

Network endpoints5

polar.sh/checkout/polar_c_Bd8xfL8VTBQtYpol2MdbS2M5acEFMsjKmDFec0bYVGF/bakit-org/products/ba-kit-solo-pro

@bakit-org/cli@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code