Loading npm security reports…

@datarails-ai/dr-cli@1.6.70: AI-agent control-surface risk | LPM Firewall

registry / @datarails-ai/dr-cli / 1.6.70

@datarails-ai/dr-cli@1.6.70

Datarails CLI

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically changes a foreign AI agent's global instruction surface. Existing Gemini installations receive package skill imports without a consent prompt.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An npm installation with lifecycle scripts enabled on a machine with an existing ~/.gemini directory.

Impact

Package instructions become available to future Gemini sessions, and subsequent package installations can refresh those instructions automatically.

Mechanism

The postinstall hook launches the CLI skill installer with the home directory as its target; Gemini setup installs skill files and writes imports into GEMINI.md.

Policy narrative

The npm postinstall hook automatically runs the skill installer against the user's home directory. Although Claude plugin detection can suppress duplicate Claude skill installation, Gemini setup runs separately whenever the Gemini directory exists. It installs bundled skills and adds imports to the global Gemini instruction file without requesting consent, allowing package installation and upgrades to alter instructions used by future agent sessions.

AI rationale

The inspected lifecycle chain performs unconsented install-time mutation of Gemini's global agent instruction file. This crosses the specified blocking boundary for foreign or broad AI-agent control surfaces despite the skills being package-owned.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js~/.gemini/GEMINI.md~/.gemini/skills/<name>/~/.claude/skills/<name>/

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2793import { randomInt } from "crypto"; L2794: import { spawn } from "child_process"; L2795: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2793

3357} L3358: function escPowerShellSingle(s) { L3359: return s.replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L3357

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `keychain set ${service}:${account}: the Windows Credential Manager is full (Windows error code 8), so this credential could not be saved. Remove saved logins you no longer need wi... import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises"; // A user-bound API key, exchanged for `access` on demand. A file may hold await writeFile(tmp, body, { mode: 384 }); * its text can be quoting the `Authorization` header it blocked. throw new Error("api-key exchange: the stored API key is empty"); "api-key exchange: dr only accepts an API key of printable ASCII with no spaces; the stored one contains whitespace, control

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

7L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

scripts/postinstall.mjsView file

49Cross-file remote execution chain: scripts/postinstall.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L49: L50: import { spawnSync } from 'node:child_process'; L51: import { existsSync } from 'node:fs'; ... L63: L64: const target = homedir(); L65: const result = spawnSync('node', [cli, 'skill', 'install', target], { stdio: 'inherit' }); ... L67: if (result.status !== 0) { L68: process.stderr.write( L69: `(dr-cli postinstall: skill copy returned ${result.status} — run \`dr skill install ~\` to retry)\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L49

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 36-58json

36 "eslint": "^9.7.0",

37 "jsdom": "^29.1.1",

38 "msw": "^2.3.0",

39 "prettier": "^3.3.0",

40 "tsup": "^8.1.0",

41 "tsx": "^4.16.0",

42 "typescript": "^5.5.0",

43 "vitest": "^2.0.0"

44 },

45 "scripts": {

46 "dev": "tsx src/cli.ts",

47 "build": "tsup",

48 "gen:scopes": "tsx scripts/gen-scopes-map.mts",

49 "check:scopes": "tsx scripts/gen-scopes-map.mts --check",

50 "typecheck": "tsc -p tsconfig.build.json --noEmit",

51 "test": "vitest run",

52 "test:watch": "vitest",

53 "lint": "eslint",

54 "format": "prettier --write .",

55 "format:check": "prettier --check .",

56 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 }

58}

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2793import { randomInt } from "crypto"; L2794: import { spawn } from "child_process"; L2795: import * as readline from "readline";

High

Child Process

scripts/postinstall.mjsView file

Lines 29-69javascript

29// - dist/cli.js missing (dev install before `pnpm build`) — skip silently

30// - skill copy returns non-zero — log a warning and let the install

31// succeed. The user can rerun `dr skill install ~` later.

32//

33// We intentionally do NOT use `process.exit(non-zero)` from this hook,

34// because npm aborts the entire install on a non-zero postinstall exit.

35// Failing to copy a skill shouldn't break the operator's install.

36//

37// Cleaning up removed skills: when a future release drops a skill that

38// previous releases shipped, add an explicit `rm` call here for the

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg