Loading npm security reports…

@datarails-ai/dr-cli@1.6.74: AI-agent control-surface risk | LPM Firewall

registry / @datarails-ai/dr-cli / 1.6.74

@datarails-ai/dr-cli@1.6.74

Datarails CLI

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically changes home-directory AI-agent instructions and MCP configuration. The global Gemini instruction write establishes an unconsented mutation of a foreign agent control surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

An npm installation that runs the postinstall hook.

Impact

Subsequent agent sessions receive package-supplied instructions and an automatically registered tool server; upgrades can restore these changes.

Mechanism

The hook launches bundled CLI commands to install embedded skills, insert Gemini instruction imports, and persist a Claude MCP launch entry without requesting consent.

Policy narrative

The npm postinstall hook runs skill installation with the user's home directory as its target. The bundled command installs agent skills and, when Gemini is present, updates its global instruction file without asking permission. A second automatic command registers the bundled MCP server in Claude's global configuration. Claude plugin detection limits some skill copies but does not prevent the Gemini instruction mutation or MCP registration.

AI rationale

The inspected lifecycle chain performs unconsented writes to foreign global AI-agent control surfaces, including Gemini's instruction file. This meets the blocking policy even though the installed content belongs to the package and no credential theft was established.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js~/.claude/skills/<name>/~/.gemini/skills/<name>/~/.gemini/GEMINI.md~/.claude.json

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2794import { randomInt } from "crypto"; L2795: import { spawn } from "child_process"; L2796: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2794

3358} L3359: function escPowerShellSingle(s) { L3360: return s.replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L3358

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `keychain set ${service}:${account}: the Windows Credential Manager is full (Windows error code 8), so this credential could not be saved. Remove saved logins you no longer need wi... import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises"; // A user-bound API key, exchanged for `access` on demand. A file may hold await writeFile(tmp, body, { mode: 384 }); * its text can be quoting the `Authorization` header it blocked. throw new Error("api-key exchange: the stored API key is empty"); "api-key exchange: dr only accepts an API key of printable ASCII with no spaces; the stored one contains whitespace, control

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

7L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

scripts/postinstall.mjsView file

49Cross-file remote execution chain: scripts/postinstall.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L49: L50: import { spawnSync } from 'node:child_process'; L51: import { existsSync } from 'node:fs'; ... L63: L64: const target = homedir(); L65: const result = spawnSync('node', [cli, 'skill', 'install', target], { stdio: 'inherit' }); ... L67: if (result.status !== 0) { L68: process.stderr.write( L69: `(dr-cli postinstall: skill copy returned ${result.status} — run \`dr skill install ~\` to retry)\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L49

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 37-59json

37 "eslint": "^9.7.0",

38 "jsdom": "^29.1.1",

39 "msw": "^2.3.0",

40 "prettier": "^3.3.0",

41 "tsup": "^8.1.0",

42 "tsx": "^4.16.0",

43 "typescript": "^5.5.0",

44 "vitest": "^2.0.0"

45 },

46 "scripts": {

47 "dev": "tsx src/cli.ts",

48 "build": "tsup",

49 "gen:scopes": "tsx scripts/gen-scopes-map.mts",

50 "check:scopes": "tsx scripts/gen-scopes-map.mts --check",

51 "typecheck": "tsc -p tsconfig.build.json --noEmit",

52 "test": "vitest run",

53 "test:watch": "vitest",

54 "lint": "eslint",

55 "format": "prettier --write .",

56 "format:check": "prettier --check .",

57 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 }

59}

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2794import { randomInt } from "crypto"; L2795: import { spawn } from "child_process"; L2796: import * as readline from "readline";

High

Child Process

scripts/postinstall.mjsView file

Lines 29-69javascript

29// - dist/cli.js missing (dev install before `pnpm build`) — skip silently

30// - skill copy returns non-zero — log a warning and let the install

31// succeed. The user can rerun `dr skill install ~` later.

32//

33// We intentionally do NOT use `process.exit(non-zero)` from this hook,

34// because npm aborts the entire install on a non-zero postinstall exit.

35// Failing to copy a skill shouldn't break the operator's install.

36//

37// Cleaning up removed skills: when a future release drops a skill that

38// previous releases shipped, add an explicit `rm` call here for the

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg