registry / @flydocs/cli / 1.3.10
@flydocs/cli@1.3.10
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not malicious by the stated boundary: it has no npm lifecycle hook and its agent integration is user-command activated. It warrants a warning because it installs persistent agent hooks with scoped auto-approval and credentialed network behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `flydocs init` or updates an initialized FlyDocs project; configured agent lifecycle events then invoke installed hooks.
Impact
Installed hooks can influence agent tool permissions and send the FlyDocs credential to the configured FlyDocs relay.
Mechanism
First-party agent-extension installation with scoped script auto-approval and relay-backed cloud hooks.
AI rationale
The package is not malicious by the stated boundary: it has no npm lifecycle hook and its agent integration is user-command activated. It warrants a warning because it installs persistent agent hooks with scoped auto-approval and credentialed network behavior.
Evidence
package.jsondist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/auto-approve.pytemplate/.claude/hooks/session-start.py.claude/skills.claude/commands.claude/hooks.claude/agents.claude/settings.json.claude/CLAUDE.mdAGENTS.md.cursor/rules~/.flydocs/credentials
Network endpoints1
app.flydocs.ai/api/relay
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Explicit init deploys managed Claude hooks, skills, agents, and settings.
- Packaged Claude settings execute lifecycle hook scripts.
- PreToolUse hook auto-allows package-owned Python workflow scripts.
- Cloud hook reads FlyDocs credential and sends it only to the FlyDocs relay.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Agent configuration is activated by explicit `flydocs init`; Codex registration requires `flydocs connect codex`.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
14 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 824283
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @flydocs/cli@1.3.8
matchedIdentity = npm:QGZseWRvY3MvY2xp:1.3.8
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg130});
L131: import { spawnSync } from "child_process";
L132: import { readFile as readFile2, realpath } from "fs/promises";
High
Findings
2 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dir
Affected versions and remediation
This report applies to @flydocs/cli@1.3.10.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.