registry / @hatchway/cli / 0.51.31

@hatchway/cli@0.51.31

Hatchway CLI - Build AI-powered apps with Claude. Just run: npx @hatchway/cli runner

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Explicit CLI execution triggers an automatic update check. When a newer release is reported, it downloads and executes a remote shell installer, then may force-upgrade the configured Hatchway app.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running any non-version `hatchway` CLI command while auto-update is enabled and a newer release is reported.

Impact

A remote installer from `hatchway.sh` can execute with the invoking user's permissions.

Mechanism

Automatic remote shell installer execution and forced monorepo upgrade.

Rationale

Source inspection does not establish malicious intent or install-time compromise, but it confirms an unattended remote shell-update capability on normal CLI use. Downgrade to warn for this dangerous capability rather than publishing a block.

Evidence

package.jsonbin/hatchway.jsdist/cli/index.jsdist/chunks/auto-update-Ddo5Ntt7.jsdist/chunks/database-setup-BdXiI4MV.jsdist/index.js~/.config/hatchway/update-cache.json

Network endpoints2

api.github.com/repos/codyde/hatchway/releases/latesthatchway.sh/install

@hatchway/cli@0.51.31

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code