registry / @cotal-ai/cli / 0.129.6
@cotal-ai/cli@0.129.6
Cotal mesh CLI: up, join, watch, console, spawn, mint, channels, history, ext.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest contains no install lifecycle hook. The flagged process execution and agent-skill writes are tied to CLI operations, while telemetry is disclosed and has an off setting; reviewed feedback transmission requires an explicit command.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Telemetry runs after eligible CLI commands; agent skills are installed by `cotal setup`; feedback is submitted only through the feedback command.
Impact
Telemetry reports usage data. Setup makes Cotal skills available to supported agent tools. No unauthorized credential transfer or account action was found.
Mechanism
Telemetry sends usage events to the package's stated endpoint. Setup copies package-authored skill files to `~/.agents/skills`. Feedback submits a report to the configured or package feedback intake.
AI rationale
The manifest contains no install lifecycle hook. The flagged process execution and agent-skill writes are tied to CLI operations, while telemetry is disclosed and has an off setting; reviewed feedback transmission requires an explicit command.
Evidence
~/.agents/skills~/.cotal/agent-skills.json
Network endpoints2
cotal.aibroker.cotal.ai
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall lifecycle hook.
- Runtime telemetry is disclosed, sends command usage on process exit, and provides `cotal telemetry off`; its endpoint is `https://cotal.ai/v1/telemetry`.
- Agent Skills are reconciled into `~/.agents/skills` by the explicit `cotal setup` command.
- The optional global npm install is offered during `npx` setup and is skipped when the user declines.
Evidence against
- No malicious behavior was identified in the reviewed process execution, feedback, or account-action paths.
- The feedback command sends a report only when explicitly invoked; a supplied credential is sent as a bearer token to the feedback intake.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
18 flaggeddist/seed/reconcile.jsView file
1import { existsSync, renameSync } from "node:fs";
L2: import { spawnSync } from "node:child_process";
L3: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/seed/reconcile.jsView on unpkg · L1dist/lib/persona-files.jsView file
274process.on(signal, pass);
L275: const child = program ? spawn(program, [draft], { stdio: "inherit" }) : spawn(`${editor} ${quoted}`, { shell: true, stdio: "inherit" });
L276: return new Promise(resolve => {
High
dist/lib/nats-bin.jsView file
Findings
17 High4 Medium4 Low
HighChild Processdist/seed/reconcile.js
HighShelldist/lib/persona-files.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/lib/agent-skills.js
HighRuntime Package Installdist/commands/setup.js
HighSemantic Analysis Limiteddist/commands/ext.js
HighKnown Malware Source Similaritydist/telemetry.js
HighKnown Malware Source Similaritydist/commands/up.js
HighKnown Malware Source Similaritydist/lib/self-exec.js
HighKnown Malware Source Similaritydist/lib/service-process.js
HighKnown Malware Source Similaritydist/commands/ext.js
HighKnown Malware Source Similaritydist/commands/setup-start.js
Affected versions and remediation
This report applies to @cotal-ai/cli@0.129.6.
See all versions of @cotal-ai/cli for other recorded verdicts.
- Review the evidence and your use of @cotal-ai/cli@0.129.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.