registry / @catalyst-cloud/cli / 0.16.40
@catalyst-cloud/cli@0.16.40
Set up Catalyst Cloud, check your tickets and manage your account from the command line.
AI Security Review
scanned 10d ago · by lpm-firewall-aiStatic source inspection found a guarded postinstall migration of a first-party scheduled updater, which leaves residual lifecycle risk. The inspected credential flows use Catalyst service configuration or account attribution, and do not establish exfiltration or malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Global npm installation, unless CATALYST_NO_AGENT_REPOINT=1 is set.
Impact
Future scheduled runner updates use the new CLI installation. No unrelated agent configuration or credential recipient was identified.
Mechanism
The postinstall checks for a recognized older Catalyst runner updater and rewrites its schedule to invoke the new CLI, preserving the previous schedule as a backup.
AI rationale
Static source inspection found a guarded postinstall migration of a first-party scheduled updater, which leaves residual lifecycle risk. The inspected credential flows use Catalyst service configuration or account attribution, and do not establish exfiltration or malicious behavior.
Evidence
package.jsonbin/postinstall.jsdist/agent-repoint.jsdist/runner-auto-update.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs a postinstall hook; it acts only on global installs unless the opt-out variable is set.
- That hook can replace an existing Catalyst runner update schedule with this installation. The code recognizes Catalyst commands, skips schedules that are not older, and keeps a backup of the prior schedule.
- The schedule runs the Catalyst runner update command every 15 minutes. This is an automatic change to a first-party scheduled agent, so some residual lifecycle risk remains.
- The repository setup code writes within the checkout path supplied to its command; the plugin updater is a separate operation.
- Telemetry uses the saved Catalyst service base URL and checks it against the journal account and membership before sending; the inspected GitHub calls also use the saved service base URL.
- Codex attribution reads an account identifier for attribution, and its environment apply path writes an OpenTelemetry attribute through the macOS launch service. No unrelated credential recipient was identified.
Evidence against
- The postinstall is limited to global installs and can be disabled with CATALYST_NO_AGENT_REPOINT=1.
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/launch.jsView file
61const noticeLast = deprecated && !noticeFirst;
L62: import("../dist/cli.js")
L63: .then((m) => m.main(argv))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/launch.jsView on unpkg · L61Findings
1 Critical4 High7 Medium5 Low
CriticalAi Agent Control Hijackdist/agent-repoint.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/agent-repoint.js
HighSemantic Analysis Limiteddist/codex-env.js#virtual:string-array:round1
HighPrevious Version Dangerous Deltadist/runner-auto-update.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/codex-attribution.js
MediumShips Build Helpervendor/self-host/host-disk-sample.py
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @catalyst-cloud/cli@0.16.40.
See all versions of @catalyst-cloud/cli for other recorded verdicts.
- Review the evidence and your use of @catalyst-cloud/cli@0.16.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.