registry / @catalyst-cloud/cli / 0.16.43
@catalyst-cloud/cli@0.16.43
Set up Catalyst Cloud, check your tickets and manage your account from the command line.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe global-install hook automatically changes a persistent user-level runner update agent without asking first, so this deserves a warning. The change is narrowly limited to an older Catalyst updater, preserves a backup, and no malicious credential flow or unrelated data collection was identified in the reviewed paths.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall during a global install, unless CATALYST_NO_AGENT_REPOINT=1 is set.
Impact
The installation changes a persistent user-level scheduled task without an interactive confirmation. The reviewed code limits this to the package's own runner updater and performs a forward version update.
Mechanism
The hook recognizes an older Catalyst runner schedule and rewrites its launchd or systemd configuration to run this installation; it keeps a versioned backup and restores the original on failure.
AI rationale
The global-install hook automatically changes a persistent user-level runner update agent without asking first, so this deserves a warning. The change is narrowly limited to an older Catalyst updater, preserves a backup, and no malicious credential flow or unrelated data collection was identified in the reviewed paths.
Evidence
package.jsonbin/postinstall.jsdist/agent-repoint.jsdist/runner-auto-update.js~/Library/LaunchAgents/dev.catalystcloud.runner-update.plist~/.config/systemd/user/catalyst-runner-update.service~/.config/systemd/user/catalyst-runner-update.timer<agent-file>.before-<version><runner-directory>/update.log
Network endpoints1
staging.catalystcloud.dev/install.sh
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook runs automatically on global installs unless CATALYST_NO_AGENT_REPOINT=1 is set.
- The hook can rewrite an existing runner update agent to use this installation, creating a backup of the previous agent file.
- The agent-repoint code only recognizes this CLI's runner update schedule and moves it forward from an older version.
- Onboarding failure telemetry requires a matching logged-in account and sends to the account's configured base URL.
Evidence against
- The repoint is limited to global installs and can be disabled with CATALYST_NO_AGENT_REPOINT=1.
- The code checks that the existing agent is recognized, the current CLI is older, and the relevant files are writable before changing it.
- The previous agent file is retained as a versioned backup; a failed repoint restores the original.
- Telemetry uses a short-lived token issued by the configured service and is only called from the onboarding custody-failure path.
Behavioral surface
ChildProcessCryptoDynamicRequire
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/launch.jsView file
61const noticeLast = deprecated && !noticeFirst;
L62: import("../dist/cli.js")
L63: .then((m) => m.main(argv))
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/launch.jsView on unpkg · L61Findings
1 Critical3 High7 Medium5 Low
CriticalAi Agent Control Hijackdist/agent-repoint.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/agent-repoint.js
HighSemantic Analysis Limiteddist/codex-env.js#virtual:string-array:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/launch.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/codex-attribution.js
MediumShips Build Helpervendor/self-host/host-disk-sample.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to @catalyst-cloud/cli@0.16.43.
See all versions of @catalyst-cloud/cli for other recorded verdicts.
- Review the evidence and your use of @catalyst-cloud/cli@0.16.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.