registry / @customerio/cli / 0.0.23
@customerio/cli@0.0.23
Agent-first CLI for Customer.io APIs
AI Security Review
scanned 25d ago · by lpm-firewall-aiAutomatic lifecycle-based agent-extension setup warrants a warning because its final behavior is delegated to an unavailable platform binary. The inspected code does not establish a concrete malicious attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the npm package.
Impact
This can set up a first-party agent extension automatically; no confirmed malicious action was established from the inspected wrapper.
Mechanism
The post-install script resolves a platform-specific optional dependency and launches its skills-install subcommand with project or global scope.
AI rationale
Automatic lifecycle-based agent-extension setup warrants a warning because its final behavior is delegated to an unavailable platform binary. The inspected code does not establish a concrete malicious attack.
Evidence
.npm/postinstall.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package declares an automatic post-install script.
- The post-install launcher runs a platform binary with a skills-install command and selects project scope for ordinary installs.
Evidence against
- The inspected wrapper only resolves a declared platform dependency before launching it; it contains no credential collection, network request, or file-write operation.
- No self-dependency or opaque JavaScript payload was present in the inspected package files.
Behavioral surface
NoLicense
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node .npm/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node .npm/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg5"bin": {
"cio": ".npm/run.js"
},
"scripts": {
"postinstall": "node .npm/postinstall.js"
},
"files": [
".npm/run.js",
".npm/postinstall.js",
"LICENSE",
Medium
Ai Review Evidence
The package declares an automatic post-install script.
package.jsonView on unpkg · L5.npm/postinstall.jsView file
Findings
1 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAi Review Evidencepackage.json
MediumAi Review Evidence.npm/postinstall.js
LowScripts Present
LowNo License
Affected versions and remediation
This report applies to @customerio/cli@0.0.23.
See all versions of @customerio/cli for other recorded verdicts.
- Review the evidence and your use of @customerio/cli@0.0.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.