registry / @flydocs/cli / 1.3.8
@flydocs/cli@1.3.8
FlyDocs AI CLI — install, setup, and manage FlyDocs projects
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms explicit-user-command agent control-surface writes and relay-supplied artifact execution. The static malicious label overstates the evidence because there is no npm lifecycle execution or confirmed malicious exfiltration chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs flydocs init or update for a cloud project.
Impact
A compromised or malicious relay response could gain code execution in the initialized project and expanded Claude tool approval.
Mechanism
first-party agent-extension installation plus relay-supplied artifact execution
AI rationale
Source inspection confirms explicit-user-command agent control-surface writes and relay-supplied artifact execution. The static malicious label overstates the evidence because there is no npm lifecycle execution or confirmed malicious exfiltration chain.
Evidence
package.jsondist/cli.jstemplate/.claude/settings.jsontemplate/.claude/hooks/auto-approve.py.claude/settings.json.claude/hooks/auto-approve.py.claude/skills/flydocs-workflow/scripts/context.py.mcp.json.cursor/mcp.json.vscode/mcp.json
Network endpoints1
app.flydocs.ai/api/relay
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Bundled Claude settings installs command hooks.
- Hook auto-allows bundled FlyDocs Python scripts.
- Cloud init syncs server artifacts, then runs context.py.
- Artifact sync writes server-supplied content into the project.
Evidence against
- package.json has no preinstall/install/postinstall lifecycle hook.
- Behavior is reached through explicit CLI init/update actions, not package installation.
- Observed relay endpoint is FlyDocs-branded; no unrelated exfiltration host was found.
- Template hook source is readable; no hidden binary payload was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
14 flaggeddist/cli.jsView file
•path = dist/cli.js
kind = trigger_reachable_excluded_payload
sizeBytes = 813675
triggerReachableSource = dist/cli.js
excludedPayload = template/.claude/hooks/auto-approve.py
Critical
Trigger Reachable Excluded Directory Payload
A package entrypoint or install-reachable source explicitly loads and activates an executable-looking payload from a test, fixture, or hidden path.
dist/cli.jsView on unpkg•matchType = previous_version_dangerous_delta
matchedPackage = @flydocs/cli@1.3.5
matchedIdentity = npm:QGZseWRvY3MvY2xp:1.3.5
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg127});
L128: import { spawnSync } from "child_process";
L129: import { readFile as readFile2, realpath } from "fs/promises";
High
Findings
2 Critical10 High5 Medium5 Low
CriticalTrigger Reachable Excluded Directory Payloaddist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/cli.js
HighShelldist/cli.js
HighCredential Exfiltrationdist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
HighPayload In Excluded Dir
Affected versions and remediation
This report applies to @flydocs/cli@1.3.8.
See all versions of @flydocs/cli for other recorded verdicts.
- Review the evidence and your use of @flydocs/cli@1.3.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.