registry  /  @chojs23/concord  /  2.2.13

@chojs23/concord@2.2.13

A terminal user interface client for Discord

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The package is an npm wrapper that installs and runs a prebuilt Concord TUI binary. The unresolved risk is install-time retrieval of an executable archive, but the source-visible behavior is package-aligned rather than clearly malicious.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall, or running concord/npx @chojs23/concord
Impact
Downloads and extracts a package-owned executable into the package directory, then runs it when the CLI is invoked.
Mechanism
install-time platform binary downloader and CLI launcher
Attack narrative
On install, postinstall calls install.js, which resolves the current platform, downloads the matching archive from the package's GitHub release URL, deletes/recreates node_modules/.bin_real, and extracts the archive there. The concord bin wrapper later spawns that extracted executable with user arguments. This is a staged binary delivery pattern, but it is documented and aligned with the package's stated Discord TUI client purpose.
Rationale
Source inspection shows a documented package-aligned prebuilt binary installer with no confirmed exfiltration, persistence, destructive behavior, or AI-agent control hijack. Because the executable payload is fetched at install time without source-visible integrity verification, warn rather than block.
Evidence
package.jsoninstall.jsbinary.jsbinary-install.jsrun-concord.jsREADME.mdnode_modules/.bin_real
Network endpoints1
github.com/chojs23/concord/releases/download/v2.2.13

Decision evidence

public snapshot
AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node ./install.js
  • install.js invokes binary.install(false) during npm install
  • binary-install.js downloads a platform archive with axios and extracts it into node_modules/.bin_real
  • binary-install.js later runs the installed concord binary via spawnSync from run-concord.js
  • No artifact hash/signature verification is present in installer source
Evidence against
  • Download URL is package-aligned GitHub release path for chojs23/concord v2.2.13
  • README.md documents npm installs prebuilt GitHub Release binary
  • No credential/env harvesting, broad filesystem scanning, persistence, or exfiltration in JS wrapper source
  • No AI-agent control surface writes or foreign config mutations found
  • Network use is limited in JS source to release artifact download/proxy support
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
Manifest
CopyleftLicense
scanned 4 file(s), 10.0 KB of source, external domains: example.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
LowCopyleft License