Loading npm security reports…

@datarails-ai/dr-cli@1.6.73: AI-agent control-surface risk | LPM Firewall

registry / @datarails-ai/dr-cli / 1.6.73

@datarails-ai/dr-cli@1.6.73

Datarails CLI

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic npm installation changes global AI-agent instructions and MCP configuration without a consent prompt. These writes reach foreign agent control surfaces beyond the package's own configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

An npm installation that runs the postinstall hook.

Impact

Subsequent agent sessions can load package-provided instructions and launch the registered package command; later installations repeat the configuration writes.

Mechanism

The hook invokes CLI commands that install home-directory skills, add Gemini instruction imports, and overwrite a Claude MCP registration.

Policy narrative

The registry installation hook launches the CLI to install skills in the user's home directory and register dr-zendesk-kb. The skill installer modifies Gemini's global instruction file when Gemini is present, while MCP registration writes directly to Claude's global configuration. Neither operation requests consent in the inspected chain. The installed-plugin check limits Claude skill copying but leaves these broader control-surface mutations active.

AI rationale

The inspected automatic postinstall chain performs unconsented writes to foreign global AI-agent control surfaces, meeting the specified blocking boundary. Package-owned integration names and partial installation guards do not gate those writes.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js.claude.json.gemini/GEMINI.md

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2793import { randomInt } from "crypto"; L2794: import { spawn } from "child_process"; L2795: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2793

3357} L3358: function escPowerShellSingle(s) { L3359: return s.replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L3357

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `keychain set ${service}:${account}: the Windows Credential Manager is full (Windows error code 8), so this credential could not be saved. Remove saved logins you no longer need wi... import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises"; // A user-bound API key, exchanged for `access` on demand. A file may hold await writeFile(tmp, body, { mode: 384 }); * its text can be quoting the `Authorization` header it blocked. throw new Error("api-key exchange: the stored API key is empty"); "api-key exchange: dr only accepts an API key of printable ASCII with no spaces; the stored one contains whitespace, control

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

7L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @datarails-ai/dr-cli@1.6.71 matchedPath = dist/cli.js matchedIdentity = npm:QGRhdGFyYWlscy1haS9kci1jbGk:1.6.71 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 8b0a028250a41d29 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @datarails-ai/dr-cli@1.6.71 matchedPath = dist/cli.js matchedIdentity = npm:QGRhdGFyYWlscy1haS9kci1jbGk:1.6.71 similarity = 1.000 shingleOverlap = 8 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

scripts/postinstall.mjsView file

49Cross-file remote execution chain: scripts/postinstall.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L49: L50: import { spawnSync } from 'node:child_process'; L51: import { existsSync } from 'node:fs'; ... L63: L64: const target = homedir(); L65: const result = spawnSync('node', [cli, 'skill', 'install', target], { stdio: 'inherit' }); ... L67: if (result.status !== 0) { L68: process.stderr.write( L69: `(dr-cli postinstall: skill copy returned ${result.status} — run \`dr skill install ~\` to retry)\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L49

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 36-58json

36 "eslint": "^9.7.0",

37 "jsdom": "^29.1.1",

38 "msw": "^2.3.0",

39 "prettier": "^3.3.0",

40 "tsup": "^8.1.0",

41 "tsx": "^4.16.0",

42 "typescript": "^5.5.0",

43 "vitest": "^2.0.0"

44 },

45 "scripts": {

46 "dev": "tsx src/cli.ts",

47 "build": "tsup",

48 "gen:scopes": "tsx scripts/gen-scopes-map.mts",

49 "check:scopes": "tsx scripts/gen-scopes-map.mts --check",

50 "typecheck": "tsc -p tsconfig.build.json --noEmit",

51 "test": "vitest run",

52 "test:watch": "vitest",

53 "lint": "eslint",

54 "format": "prettier --write .",

55 "format:check": "prettier --check .",

56 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 }

58}

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L251: async function cleanupV1IfPresent(opts = {}) { L252: const home = opts.home ?? os.homedir(); L253: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L254: const drDir = path.join(home, ".dr"); ... L341: function credentialsFilePath() { L342: const override = process.env[CREDENTIALS_FILE_ENV]; L343: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L354: try { L355: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2793import { randomInt } from "crypto"; L2794: import { spawn } from "child_process"; L2795: import * as readline from "readline";

High

Child Process

scripts/postinstall.mjsView file

Lines 29-69javascript

29// - dist/cli.js missing (dev install before `pnpm build`) — skip silently

30// - skill copy returns non-zero — log a warning and let the install

31// succeed. The user can rerun `dr skill install ~` later.

32//

33// We intentionally do NOT use `process.exit(non-zero)` from this hook,

34// because npm aborts the entire install on a non-zero postinstall exit.

35// Failing to copy a skill shouldn't break the operator's install.

36//

37// Cleaning up removed skills: when a future release drops a skill that

38// previous releases shipped, add an explicit `rm` call here for the

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg