registry / @civitai/cli / 0.1.76

@civitai/cli@0.1.76

The Civitai CLI — author and ship Civitai App Blocks. Installs the prebuilt Go binary.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Postinstall downloads a platform-specific executable into the package directory. Explicit `civitai` invocation launches that executable; source inspection found no data harvesting or foreign control-surface mutation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; invoking `civitai` launches the cached binary

Impact

A release-side artifact compromise could supply code executed when the CLI is run; the package's same-release checksum does not independently authenticate it.

Mechanism

remote native-binary download followed by user-invoked execution

Rationale

No concrete malicious behavior is present in the inspected JavaScript. The automatic remote native-payload delivery creates a real supply-chain execution surface, so warn rather than block.

Evidence

package.jsonlib/install.jsbin/civitai.jsREADME.mdlib/binaries/civitailib/binaries/civitai.exe

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

@civitai/cli@0.1.76

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code