@factory/cli@0.249.0
⚠ Under reviewFactory Droid CLI - AI-powered software engineering agent
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe inspected installer and platform mapping describe a platform-specific native CLI setup, but the native package contents are absent from this snapshot and the installer can execute that binary during installation. The available source does not establish malicious behavior, so review of the native payload is needed to resolve the risk.
Decision evidence
public snapshot- The manifest runs install.js during postinstall and declares platform-specific native packages as optional dependencies.
- If a platform binary is unavailable, install.js downloads and extracts a binary; it also validates the binary by running it with --version.
- platform.js maps Linux x64 to the package’s regular or baseline native binary. The native package contents are absent from this snapshot, so their behavior could not be assessed.
- The installer’s fallback uses the platform-specific package name and version from the manifest, and the manifest identifies the package as a CLI.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
Findings
Affected versions and remediation
This report applies to @factory/cli@0.249.0.
See all versions of @factory/cli for other recorded verdicts.
- Review the evidence and your use of @factory/cli@0.249.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.