registry / @catalyst-cloud/cli / 0.16.37
@catalyst-cloud/cli@0.16.37
Set up Catalyst Cloud, check your tickets and manage your account from the command line.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe flagged lifecycle behavior is narrowly gated to global installs and migrates only a recognized Catalyst runner update agent to the newer CLI, preserving a backup. The inspected agent configuration, account attribution, and dependency paths did not establish a malicious attack surface.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A global npm install, when a recognized older Catalyst runner update agent exists.
Impact
The inspected behavior is a same-vendor update migration; no concrete attack impact was established.
Mechanism
The postinstall checks the agent’s command and version, then replaces its CLI path while retaining the runner arguments and a backup.
AI rationale
The flagged lifecycle behavior is narrowly gated to global installs and migrates only a recognized Catalyst runner update agent to the newer CLI, preserving a backup. The inspected agent configuration, account attribution, and dependency paths did not establish a malicious attack surface.
Evidence
bin/postinstall.jsdist/agent-repoint.jsdist/runner-auto-update.js
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s postinstall runs a script that acts only on global installs; local and workspace installs do nothing, and an environment flag disables the action.
- The action recognizes only an existing Catalyst runner update agent, skips a same-or-newer CLI, and updates the agent to this package while preserving a backup.
- Repository agent setup writes only when invoked with --apply; the plugin updater requires user scope and verifies its source before updating.
- Codex attribution reads the local account ID for a hashed slot lookup. A stale account cache can be refreshed from the Catalyst coding-accounts API; the inspected code does not send the raw ID as a credential.
- Inspected dependency and replica sources concern the Catalyst SDK, terminal formatting, and an optional local replica; no attack behavior was identified in them.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/launch.jsView file
61const noticeLast = deprecated && !noticeFirst;
L62: import("../dist/cli.js")
L63: .then((m) => m.main(argv))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/launch.jsView on unpkg · L61Findings
1 Critical4 High7 Medium5 Low
CriticalAi Agent Control Hijackdist/agent-repoint.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/agent-repoint.js
HighSemantic Analysis Limiteddist/codex-env.js#virtual:string-array:round1
HighPrevious Version Dangerous Deltadist/runner-auto-update.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/codex-attribution.js
MediumShips Build Helpervendor/self-host/host-disk-sample.py
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @catalyst-cloud/cli@0.16.37.
See all versions of @catalyst-cloud/cli for other recorded verdicts.
- Review the evidence and your use of @catalyst-cloud/cli@0.16.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.