registry  /  @hiperplano/aluy-cli  /  1.0.0-rc.76

@hiperplano/aluy-cli@1.0.0-rc.76

Aluy CLI — TUI (Ink) + binário `aluy` + wiring. Consome @hiperplano/aluy-cli-core (engine portável). Credenciais só no keychain do SO.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a bundled AI CLI with expected command execution, file editing, network model/broker calls, and local sidecar management behind user-invoked CLI workflows.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the aluy CLI or imports the package entrypoint
Impact
Package-aligned local automation and model/broker access; no confirmed credential exfiltration or stealth execution
Mechanism
User-invoked AI CLI tools with permission and sandbox checks
Rationale
Static inspection confirms the scanner hit real dangerous primitives, but they are core to an AI terminal CLI and are guarded or user-invoked rather than install-time or covert behavior. I found no concrete unauthorized exfiltration, persistence, destructive payload, or lifecycle execution path.
Evidence
package.jsondist-bundle/bin/aluy.jsdist-bundle/index.jsassets/mem0/aluy-mem0-server.pyREADME.md
Network endpoints9
api.aluy.app/api/v1broker.dev.aluy.exampleapi.openai.com/v1api.anthropic.comopenrouter.ai/api/v1html.duckduckgo.com/html/api.telegram.org127.0.0.1:11434127.0.0.1:11435

Decision evidence

public snapshot
AI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for block
  • dist-bundle/bin/aluy.js contains an AI-agent run_command tool and child_process usage
  • dist-bundle/bin/aluy.js can contact broker/model/search/OAuth endpoints during user-invoked CLI flows
  • assets/mem0/aluy-mem0-server.py can reset local ~/.aluy/memory stores when incompatible
Evidence against
  • package.json has no lifecycle scripts; execution is via main/bin only
  • Network hosts are package-aligned: Aluy broker, model providers, OAuth, DuckDuckGo, Telegram, localhost sidecars
  • Credentials are read from env/keyring for login/model provider use; no source-confirmed secret harvesting loop or exfil endpoint
  • run_command/edit/write tools have permission gating, workspace controls, sensitive path denials, and sandboxing logic
  • Mem0 server binds to 127.0.0.1 and stores local memory under ~/.aluy/memory
  • No install-time/import-time payload, persistence hook, dependency confusion, or unconsented AI-agent config mutation found
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Manifest
NoLicense
scanned 2 file(s), 1.90 MB of source, external domains: 127.0.0.1, api.aluy.app, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, broker.dev.aluy.example, claude.ai, console.anthropic.com, duckduckgo.com, generativelanguage.googleapis.com, github.com, ollama.com, openrouter.ai, registry.npmjs.org

Source & flagged code

9 flagged · loading source
dist-bundle/bin/aluy.jsView file
129${n.snippet}`.trimEnd());return[`Resultados de busca para "${t}" (DuckDuckGo):`,...o,"","(As URLs acima N\xC3O foram buscadas. Para abrir uma, use web_fetch \u2014 ela passar\xE1 n... L130: `)}var $W,BW,rR,UW,sR,Kf,aR=p(()=>{"use strict";Lr();zf();Ck();$W=8;BW=Object.freeze({type:"object",properties:{url:{type:"string",description:"OBRIGAT\xD3RIO. A URL http(s) a busc... L131: ... L135: ${t.trim()}`}}function gR(t,e,o=pu){let{older:n,recent:r}=Jf(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[hR(e,n... L136: `),pu=4,Vf=1500,Xf=.4,Yf=48e3;Ai=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},fu=class{model;ke... L137: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ye(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function a6(t,e,o){let n... ... L141: `)}function T6(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var aO=p(()=>{"use strict"});var lO=p(()=>{"use strict";dp();HR();qR();WR();GR();KR();JR();Mm();nO();aO()... L142: `,r;try{r=K6(o,xx.O_CREAT|xx.O_EXCL|xx.
Critical
Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist-bundle/bin/aluy.jsView on unpkg · L129
88L89: `):void 0}function FT(t,e,o){if(o===void 0)return e;let n=Nv(t.model);return n===void 0?e:o(n)}var TT,_T,RT,bi,Hv,OT,MT,Hq,qv,qc,Wv=p(()=>{"use strict";pv();$v();Bv();si();Fv();Ff(... L90:
High
Child Process

Package source references child process execution.

dist-bundle/bin/aluy.jsView on unpkg · L88
135${t.trim()}`}}function gR(t,e,o=pu){let{older:n,recent:r}=Jf(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[hR(e,n... L136: `),pu=4,Vf=1500,Xf=.4,Yf=48e3;Ai=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},fu=class{model;ke... L137: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ye(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function a6(t,e,o){let n... ... L141: `)}function T6(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var aO=p(()=>{"use strict"});var lO=p(()=>{"use strict";dp();HR();qR();WR();GR();KR();JR();Mm();nO();aO()... L142: `,r;try{r=K6(o,xx.O_CREAT|xx.O_EXCL|xx.O_WRONLY,eG),Y6(r,n),MO(r),r=void 0,J6(o,this.file)}catch(s){if(r!==void 0)try{MO(r)}catch{}try{Q6(o)}catch{}throw s}}}});function Ax(t){let ... L143: `}`)}}else process.stderr.write(`${l?"\r":""} baixando ${e}... ${m} MB${l?"":`
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-bundle/bin/aluy.jsView on unpkg · L135
8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var G8,z8,Ay=p(()=>{"use strict";G8="<<<FIM_DADO>>>",z8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as K8}from"node:crypto";function Dy(t,e){let o=[...t,e];return o.length>Cy?o... L13: ... L23: L24: `)+q}}}]}var us,Iy,AC,jm=p(()=>{"use strict";Ry();Ql();Fy();us="room_post",Iy="room_read",AC=["ask","inform","result","ack"]});function Hm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var Zm=p(()=>{"use strict"});function pD(t=globalThis.process?.env??{}){let e=cD(t[dD]),o=cD(t[mD]);return{maxConsecutiveLineRepeats:e!==void 0
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist-bundle/bin/aluy.jsView on unpkg · L8
8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var G8,z8,Ay=p(()=>{"use strict";G8="<<<FIM_DADO>>>",z8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as K8}from"node:crypto";function Dy(t,e){let o=[...t,e];return o.length>Cy?o... L13: ... L23: L24: `)+q}}}]}var us,Iy,AC,jm=p(()=>{"use strict";Ry();Ql();Fy();us="room_post",Iy="room_read",AC=["ask","inform","result","ack"]});function Hm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var Zm=p(()=>{"use strict"});function pD(t=globalThis.process?.env??{}){let e=cD(t[dD]),o=cD(t[mD]);return{maxConsecutiveLineRepeats:e!==void 0
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist-bundle/bin/aluy.jsView on unpkg · L8
8Cross-file remote execution chain: dist-bundle/bin/aluy.js spawns dist-bundle/index.js; helper contains network access plus dynamic code execution. L8: ${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var G8,z8,Ay=p(()=>{"use strict";G8="<<<FIM_DADO>>>",z8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as K8}from"node:crypto";function Dy(t,e){let o=[...t,e];return o.length>Cy?o... L13: ... L23: L24: `)+q}}}]}var us,Iy,AC,jm=p(()=>{"use strict";Ry();Ql();Fy();us="room_post",Iy="room_read",AC=["ask","inform","result","ack"]});function Hm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}…
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-bundle/bin/aluy.jsView on unpkg · L8
8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var G8,z8,Ay=p(()=>{"use strict";G8="<<<FIM_DADO>>>",z8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as K8}from"node:crypto";function Dy(t,e){let o=[...t,e];return o.length>Cy?o... L13: ... L23: L24: `)+q}}}]}var us,Iy,AC,jm=p(()=>{"use strict";Ry();Ql();Fy();us="room_post",Iy="room_read",AC=["ask","inform","result","ack"]});function Hm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var Zm=p(()=>{"use strict"});function pD(t=globalThis.process?.env??{}){let e=cD(t[dD]),o=cD(t[mD]);return{maxConsecutiveLineRepeats:e!==void 0
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-bundle/bin/aluy.jsView on unpkg · L8
dist-bundle/index.jsView file
426Trigger-reachable chain: manifest.main -> dist-bundle/index.js L426: - Credencial S\xD3 no keychain do SO \u2014 nunca em texto em claro. L427: - Loop de agente + ferramentas nativas + controle de permiss\xE3o integrados.`;function Ve(t,e,o={}){let n=`--${e}=`;for(let r=0;r<t.length;r++){let s=t[r];if(s===`--${e}`){let i=t... L428: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`),f({status:O,body:Y,...j?{contentType:j}:{}})}),D.on("close",()=>{if(l)return;let Y=Buffer.concat(P).toString("utf8")+(W?` ... L430: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`;f({status:O,body:ne,...j?{contentType:j}:{}});return}d(Y)})}),E=()=>{g.destroy(),d(new Error("cancelado"))},w=setTimeout(()=>... L431: ${Zo(E)}`}}catch(h){let y=u?`o proxy n\xE3o respondeu em ${f}ms (timeout)`:h instanceof Error?h.message:String(h);return{ok:!1,display:c,observation:`headroom_retrieve: falha ao fa... L432: [arquivo truncado: lidos ${this.maxReadBytes} de ${s} bytes]`:n}async readFileMeta(e){let o=this.workspace.resolveInside(e),{content:n,truncated:r,binary:s}=await Yi(o,this.maxRead...
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-bundle/index.jsView on unpkg · L426
assets/mem0/aluy-mem0-server.pyView file
•path = assets/mem0/aluy-mem0-server.py kind = build_helper sizeBytes = 20729 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/mem0/aluy-mem0-server.pyView on unpkg

Findings

2 Critical5 High6 Medium5 Low
CriticalCommand Output Exfiltrationdist-bundle/bin/aluy.js
CriticalTrigger Reachable Dangerous Capabilitydist-bundle/index.js
HighChild Processdist-bundle/bin/aluy.js
HighSame File Env Network Executiondist-bundle/bin/aluy.js
HighSandbox Evasion Gated Capabilitydist-bundle/bin/aluy.js
HighCloud Metadata Accessdist-bundle/bin/aluy.js
HighCross File Remote Execution Contextdist-bundle/bin/aluy.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-bundle/bin/aluy.js
MediumProtestware
MediumShips Build Helperassets/mem0/aluy-mem0-server.py
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License