Loading npm security reports…

@datarails-ai/dr-cli@1.6.75: AI-agent control-surface risk | LPM Firewall

registry / @datarails-ai/dr-cli / 1.6.75

@datarails-ai/dr-cli@1.6.75

Datarails CLI

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The npm postinstall hook mutates global Claude and Gemini agent control surfaces without consent. It installs skills and registers a package command as a Claude MCP server.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing or upgrading the package with npm lifecycle scripts enabled.

Impact

Subsequent agent sessions receive package-provided instructions and an additional executable tool server; later installations repeat these writes.

Mechanism

The hook launches CLI skill installation and MCP registration commands targeting the user's home directory; those commands write agent instructions and global MCP configuration.

Policy narrative

Installation automatically invokes the CLI to copy skills into home-level agent directories and register dr-zendesk-kb in Claude's global MCP configuration. Existing Gemini installations also receive skill imports in GEMINI.md. No consent prompt separates npm installation from these agent control changes. The Claude plugin guard only limits skill copying and does not guard global MCP registration or Gemini writes.

AI rationale

The inspected lifecycle chain performs unconsented install-time mutation of foreign, global AI-agent control surfaces, meeting the explicit blocking policy. Package ownership of the injected skills and MCP server does not neutralize those global configuration writes.

Evidence

package.jsonscripts/postinstall.mjsdist/cli.js~/.claude.json~/.claude/skills~/.gemini/skills~/.gemini/GEMINI.md

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2795import { randomInt } from "crypto"; L2796: import { spawn } from "child_process"; L2797: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2795

3359} L3360: function escPowerShellSingle(s) { L3361: return s.replace(/'/g, "''");

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L3359

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `keychain set ${service}:${account}: the Windows Credential Manager is full (Windows error code 8), so this credential could not be saved. Remove saved logins you no longer need wi... import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises"; // A user-bound API key, exchanged for `access` on demand. A file may hold await writeFile(tmp, body, { mode: 384 }); * its text can be quoting the `Authorization` header it blocked. throw new Error("api-key exchange: the stored API key is empty"); "api-key exchange: dr only accepts an API key of printable ASCII with no spaces; the stored one contains whitespace, control

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

7L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L7

7Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

scripts/postinstall.mjsView file

49Cross-file remote execution chain: scripts/postinstall.mjs spawns dist/cli.js; helper contains network access plus dynamic code execution. L49: L50: import { spawnSync } from 'node:child_process'; L51: import { existsSync } from 'node:fs'; ... L63: L64: const target = homedir(); L65: const result = spawnSync('node', [cli, 'skill', 'install', target], { stdio: 'inherit' }); ... L67: if (result.status !== 0) { L68: process.stderr.write( L69: `(dr-cli postinstall: skill copy returned ${result.status} — run \`dr skill install ~\` to retry)\n`,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L49

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 37-59json

37 "eslint": "^9.7.0",

38 "jsdom": "^29.1.1",

39 "msw": "^2.3.0",

40 "prettier": "^3.3.0",

41 "tsup": "^8.1.0",

42 "tsx": "^4.16.0",

43 "typescript": "^5.5.0",

44 "vitest": "^2.0.0"

45 },

46 "scripts": {

47 "dev": "tsx src/cli.ts",

48 "build": "tsup",

49 "gen:scopes": "tsx scripts/gen-scopes-map.mts",

50 "check:scopes": "tsx scripts/gen-scopes-map.mts --check",

51 "typecheck": "tsc -p tsconfig.build.json --noEmit",

52 "test": "vitest run",

53 "test:watch": "vitest",

54 "lint": "eslint",

55 "format": "prettier --write .",

56 "format:check": "prettier --check .",

57 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L57

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L57

58 }

59}

dist/cli.jsView file

7L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/cli.js L7: L8: // package.json L9: var package_default = { ... L252: async function cleanupV1IfPresent(opts = {}) { L253: const home = opts.home ?? os.homedir(); L254: const log = opts.logger ?? ((m) => process.stderr.write(m + "\n")); L255: const drDir = path.join(home, ".dr"); ... L342: function credentialsFilePath() { L343: const override = process.env[CREDENTIALS_FILE_ENV]; L344: return override !== void 0 && override !== "" ? override : DEFAULT_CREDENTIALS_FILE; ... L355: try { L356: parsed2 = JSON.parse(raw);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L7

2795import { randomInt } from "crypto"; L2796: import { spawn } from "child_process"; L2797: import * as readline from "readline";

High

Child Process

scripts/postinstall.mjsView file

Lines 29-69javascript

29// - dist/cli.js missing (dev install before `pnpm build`) — skip silently

30// - skill copy returns non-zero — log a warning and let the install

31// succeed. The user can rerun `dr skill install ~` later.

32//

33// We intentionally do NOT use `process.exit(non-zero)` from this hook,

34// because npm aborts the entire install on a non-zero postinstall exit.

35// Failing to copy a skill shouldn't break the operator's install.

36//

37// Cleaning up removed skills: when a future release drops a skill that

38// previous releases shipped, add an explicit `rm` call here for the

dist/skills/validate-workato-migration/scripts/compare_files.pyView file

•path = dist/skills/validate-workato-migration/scripts/compare_files.py kind = build_helper sizeBytes = 9438 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/validate-workato-migration/scripts/compare_files.pyView on unpkg