registry / @buildinternet/uploads / 0.6.0

@buildinternet/uploads@0.6.0

CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack surface is present. An explicit `uploads install` command installs a named agent skill and registers this package's hosted MCP endpoint with Claude Code; normal successful CLI commands may also perform an opt-out update check.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `uploads install` (agent setup) or a successful non-quiet CLI command (update hint).

Impact

The explicit installer can add a first-party skill and MCP server to the user's Claude Code environment; this is a meaningful agent-extension lifecycle change but is disclosed and user-invoked.

Mechanism

Explicit agent integration setup plus package-aligned HTTPS API and update-notifier requests.

Rationale

This is not concrete malicious behavior: the only AI-agent control-surface change is an explicit, documented first-party setup command. It remains a warning because that command installs/registers an agent extension and remote MCP endpoint.

Evidence

package.jsonbin/uploads.jsdist/cli.jsdist/commands/install.jsdist/update-check.jsdist/client.jsdist/github-gh.jsdist/keys.jsdist/config-file.js~/.cache/uploads/version-check.json~/.config/buildinternet/config

Network endpoints3

agents.uploads.sh/mcp

registry.npmjs.org/%40buildinternet%2Fuploads/latest

api.uploads.sh

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

`dist/commands/install.js` explicitly runs `npx -y skills add buildinternet/uploads --skill uploads-cli`.
`dist/commands/install.js` explicitly runs `claude mcp add` with a bearer-token header for `https://agents.uploads.sh/mcp`.
`dist/github-gh.js` and `dist/keys.js` invoke GitHub/Git subprocesses only from user-requested CLI workflows.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
`bin/uploads.js` only dispatches CLI arguments; imports do not execute installation or network calls.
`dist/cli.js` calls the installer only for the explicit `uploads install` command.
`dist/update-check.js` is a bounded, opt-out npm-registry version check with a one-day local cache.
`dist/client.js` sends configured upload/API requests; no ambient credential harvesting or unrelated exfiltration was found.
No eval/vm, dynamic code loading, hidden persistence, destructive filesystem behavior, or AI-agent writes outside the explicit installer were found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 189 KB of source, external domains: agents.uploads.sh, api.uploads.sh, app.example, github.com, raw.githubusercontent.com, registry.npmjs.org, www.w3.org

Source & flagged code

1 flagged

dist/update-check.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @buildinternet/uploads@0.5.0 matchedIdentity = npm:QGJ1aWxkaW50ZXJuZXQvdXBsb2Fkcw:0.5.0 similarity = 0.724 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update-check.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/update-check.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @buildinternet/uploads@0.5.0 matchedIdentity = npm:QGJ1aWxkaW50ZXJuZXQvdXBsb2Fkcw:0.5.0 similarity = 0.724 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update-check.jsView on unpkg

Findings

1 High2 Medium4 Low

HighPrevious Version Dangerous Deltadist/update-check.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

Source & flagged code

1 flagged

dist/update-check.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @buildinternet/uploads@0.5.0 matchedIdentity = npm:QGJ1aWxkaW50ZXJuZXQvdXBsb2Fkcw:0.5.0 similarity = 0.724 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/update-check.jsView on unpkg