@factory/cli@1.0.0
Factory Droid CLI - AI-powered software engineering agent
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s install hook is for obtaining and linking its platform binary, but its NPM_TOKEN check accepts any hostname containing "npmjs.org" and applies to metadata-selected URLs and redirects. This creates a conditional credential disclosure risk, though the source does not show an attacker-controlled destination in the normal npm flow.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation when NPM_TOKEN is set and the platform binary is missing, or a request redirects.
Impact
A malicious or compromised metadata response or redirect could expose the installer's npm token to an unrelated lookalike host.
Mechanism
install.js follows metadata-provided tarball URLs and redirects, then attaches NPM_TOKEN based on a substring hostname check rather than validating the exact npm registry host.
AI rationale
The package’s install hook is for obtaining and linking its platform binary, but its NPM_TOKEN check accepts any hostname containing "npmjs.org" and applies to metadata-selected URLs and redirects. This creates a conditional credential disclosure risk, though the source does not show an attacker-controlled destination in the normal npm flow.
Evidence
package.jsoninstall.jsbin/<platform binary>bin/droidbin/droid.backup
Network endpoints2
registry.npmjs.orgmetadata-provided tarball and redirect hosts
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The postinstall hook automatically runs install.js.
- When NPM_TOKEN is set, install.js adds it as a Bearer token whenever the requested hostname contains the string "npmjs.org"; it does not require an exact registry hostname.
- The fallback download takes its tarball URL from npm metadata and passes it to the request helper; redirects are also passed back to that helper.
- The fallback runs when the platform binary is unavailable, so the token-forwarding path can run during installation.
Evidence against
- The script describes its purpose as installing and linking the platform-specific CLI binary.
- The initial metadata request goes to registry.npmjs.org, and the NPM_TOKEN header is intended to bypass registry rate limits.
- The fallback only runs when the optional platform binary is missing; the package declares platform binaries as optional dependencies.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg9scripts.postinstall = node install.js
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L9: *
L10: * Based on esbuild's approach: https://github.com/evanw/esbuild/pull/1621
L11: * and Sentry's guide: https://sentry.engineering/blog/publishing-binaries-on-npm
L12: *
...
L19: const path = require('path');
L20: const https = require('https');
L21: const zlib = require('zlib');
...
L27: getBinaryName,
L28: getBinaryPath,
L29: detectAVX2Support,
...
L50:
L51: function validateBinaryVersion(binaryPath) {
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L9•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
Findings
6 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processinstall.js
HighShellinstall.js
HighSame File Env Network Executioninstall.js#virtual:normalized:round1
HighUnverified Remote Native Payload Installpackage.json
HighSemantic Analysis Limitedinstall.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Low
Affected versions and remediation
This report applies to @factory/cli@1.0.0.
See all versions of @factory/cli for other recorded verdicts.
- Review the evidence and your use of @factory/cli@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.