registry / AI-agent control-surface risk / @fathnakbar/devops-cli

@fathnakbar/devops-cli

DevOps multi-server deployment, Portainer stack orchestration, and environment management CLI

This report shows the evidence for @fathnakbar/devops-cli@1.0.3. 1 of 4 known versions is blocked or flagged. The newest version, 1.0.4, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic post-install hook writes to global AI-agent skill locations without an explicit user command. This meets the blocking policy for unconsented install-time mutation of foreign AI-agent control surfaces.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation triggers the post-install hook.

Impact

It changes the control instructions available to installed coding agents across the user account.

Mechanism

Automatic global AI-agent skill installation.

Policy narrative

The manifest runs scripts/postinstall.js during installation. That script creates global .agents and .claude skill directories under the user home directory and writes SKILL.md into each. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces. The CLI's Portainer API behavior is user-configured and does not establish a separate exfiltration path, but it does not mitigate the automatic agent-control mutation.

AI rationale

Evidence

package.jsonscripts/postinstall.jsdist/index.js~/.agents/skills/devops/SKILL.md~/.claude/skills/devops/SKILL.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package runs a post-install script automatically.
The install script creates global skill directories for two unrelated AI-agent ecosystems.
The script writes a skill file into both global agent locations without user action.

Evidence against

The install script contains no network request or credential collection.
Runtime network calls target a user-configured Portainer server, not a hard-coded collection endpoint.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 335 KB of source, external domains: 127.0.0.1, api.example.com, api.staging.example.com, portainer.example.com

Source & flagged code

6 flagged

package.jsonView file

Lines 1-39json

2 "name": "@fathnakbar/devops-cli",

3 "version": "1.0.3",

4 "description": "DevOps multi-server deployment, Portainer stack orchestration, and environment management CLI",

5 "type": "module",

6 "main": "./dist/index.js",

7 "bin": {

8 "devops": "./dist/index.js"

9 },

10 "files": [

11 "dist",

12 "scripts",

13 "README.md",

14 "LICENSE"

15 ],

16 "scripts": {

17 "build": "bun build ./index.ts --outfile ./dist/index.js --target node",

18 "prepublishOnly": "bun run build",

19 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "dev": "bun index.ts",

21 "test": "node ./dist/index.js --help"

22 },

23 "keywords": [

24 "devops",

25 "portainer",

26 "docker",

27 "docker-compose",

28 "multi-server",

29 "cli",

30 "deployment",

31 "build-args",

32 "env-management",

33 "agent-skill"

34 ],

35 "author": "Muhammad Fathan Akbar",

36 "license": "MIT",

37 "dependencies": {

38 "yaml": "^2.4.5"

39 }

dist/index.jsView file

Lines 2400-2440javascript

2400 test: /^/,

2401 resolve(str, onError) {

2402 onError(`Unresolved plain scalar ${JSON.stringify(str)}`);

2403 return str;

scripts/postinstall.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { existsSync, mkdirSync, writeFileSync } from "node:fs";

4import { join } from "node:path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L2

5import { homedir }

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

2420if (typeof node_buffer.Buffer === "function") { L2421: return node_buffer.Buffer.from(src, "base64"); L2422: } else if (typeof atob === "function") { ... L4882: yield* this.next(token); L4883: yield* this.end(forceDoc, endOffset); L4884: } L4885: *next(token) { L4886: if (node_process.env.LOG_STREAM) L4887: console.dir(token, { depth: null }); ... L7004: ]; L7005: function findComposeFile(customPath, cwd = process.cwd()) { L7006: if (customPath) {

Critical

Credential Exfiltration

Findings

3 Critical2 High4 Medium5 Low

CriticalCredential Exfiltrationdist/index.js

CriticalAi Agent Control Hijackscripts/postinstall.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighTrigger Reachable Credential Exfiltrationdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @fathnakbar/devops-cli@1.0.3.

The versions list below shows the verdict for each recorded version.

Avoid installing @fathnakbar/devops-cli@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-30 02:27:49.227Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

4 known versions

1.0.4latestSuspicious—WarnUnder ReviewAug 30, 2026, 2:39 AM 1.0.3shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 30, 2026, 2:23 AM 1.0.2Clean—AllowPublishedAug 30, 2026, 2:11 AM 1.0.1Suspicious—WarnUnder ReviewAug 30, 2026, 2:11 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages