registry  /  @hiperplano/aluy-cli  /  1.0.0-rc.88

@hiperplano/aluy-cli@1.0.0-rc.88

Aluy CLI — TUI (Ink) + binário `aluy` + wiring. Consome @hiperplano/aluy-cli-core (engine portável). Credenciais só no keychain do SO.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an AI agent CLI with user-invoked network, local memory, MCP, sidecar, and shell-tool capabilities that are aligned with its stated function.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the aluy CLI or imports the library entrypoint.
Impact
Expected CLI operation; no unconsented install-time execution or source-grounded exfiltration found.
Mechanism
User-invoked agent CLI with guarded local tools and provider/broker API calls
Rationale
Static source inspection shows powerful but expected AI CLI behavior behind user invocation, with no lifecycle hook, silent credential harvesting, metadata endpoint access, or non-aligned exfiltration flow. Scanner hits appear to come from bundled safety checks, provider integrations, sidecar management, and local memory features.
Evidence
package.jsondist-bundle/bin/aluy.jsdist-bundle/index.jsassets/mem0/aluy-mem0-server.py~/.aluy~/.aluy/memory~/.aluy/audit.jsonl~/.aluy/logs~/.mem0/history.db
Network endpoints12
api.aluy.app/api/v1broker.dev.aluy.exampleapi.openai.com/v1api.anthropic.comapi.deepseek.comapi.groq.com/openai/v1api.mistral.ai/v1api.x.ai/v1generativelanguage.googleapis.com/v1betaopenrouter.ai/api/v1api.telegram.orgduckduckgo.com

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
    Evidence against
    • package.json has no lifecycle scripts; only main dist-bundle/index.js and bin dist-bundle/bin/aluy.js.
    • dist-bundle/bin/aluy.js child_process use is CLI runtime: sidecar spawning, heap reexec, and subcommands after user invokes aluy.
    • Network URLs are package-aligned: Aluy broker, AI providers, OAuth, Telegram, DuckDuckGo, npm registry, GitHub/Ollama downloads, and loopback sidecars.
    • assets/mem0/aluy-mem0-server.py binds 127.0.0.1 and stores/searches local mem0 data under ~/.aluy/memory.
    • Source includes permission checks for destructive/network/escalation/sensitive actions rather than silent execution or exfiltration.
    • No install-time/import-time credential harvesting, cloud metadata access, or hardcoded exfiltration endpoint found.
    Behavioral surface
    Source
    ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
    Supply chain
    HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
    Manifest
    NoLicense
    scanned 2 file(s), 1.91 MB of source, external domains: 127.0.0.1, api.aluy.app, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, broker.dev.aluy.example, claude.ai, console.anthropic.com, duckduckgo.com, generativelanguage.googleapis.com, github.com, ollama.com, openrouter.ai, registry.npmjs.org

    Source & flagged code

    9 flagged · loading source
    dist-bundle/bin/aluy.jsView file
    129${n.snippet}`.trimEnd());return[`Resultados de busca para "${t}" (DuckDuckGo):`,...o,"","(As URLs acima N\xC3O foram buscadas. Para abrir uma, use web_fetch \u2014 ela passar\xE1 n... L130: `)}var qW,WW,lR,GW,cR,Yf,dR=p(()=>{"use strict";Ir();Kf();Tk();qW=8;WW=Object.freeze({type:"object",properties:{url:{type:"string",description:"OBRIGAT\xD3RIO. A URL http(s) a busc... L131: ... L135: ${t.trim()}`}}function kR(t,e,o=gu){let{older:n,recent:r}=Qf(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[vR(e,n... L136: `),gu=4,Xf=1500,Jf=.4,Vf=48e3;Di=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},hu=class{model;ke... L137: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ye(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function m6(t,e,o){let n... ... L141: `)}function L6(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var dO=p(()=>{"use strict"});var mO=p(()=>{"use strict";mp();zR();KR();YR();VR();JR();tO();Lm();aO();dO()... L142: `,r;try{r=Q6(o,wx.O_CREAT|wx.O_EXCL|wx.
    Critical
    Command Output Exfiltration

    Source executes local commands and sends command output to an external endpoint.

    dist-bundle/bin/aluy.jsView on unpkg · L129
    88L89: `):void 0}function BT(t,e,o){if(o===void 0)return e;let n=Bv(t.model);return n===void 0?e:o(n)}var MT,LT,PT,ki,Wv,FT,IT,Kq,Gv,Gc,zv=p(()=>{"use strict";gv();Uv();jv();li();Nv();If(... L90:
    High
    Child Process

    Package source references child process execution.

    dist-bundle/bin/aluy.jsView on unpkg · L88
    135${t.trim()}`}}function kR(t,e,o=gu){let{older:n,recent:r}=Qf(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[vR(e,n... L136: `),gu=4,Xf=1500,Jf=.4,Vf=48e3;Di=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},hu=class{model;ke... L137: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ye(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function m6(t,e,o){let n... ... L141: `)}function L6(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var dO=p(()=>{"use strict"});var mO=p(()=>{"use strict";mp();zR();KR();YR();VR();JR();tO();Lm();aO();dO()... L142: `,r;try{r=Q6(o,wx.O_CREAT|wx.O_EXCL|wx.O_WRONLY,sG),Z6(r,n),IO(r),r=void 0,oG(o,this.file)}catch(s){if(r!==void 0)try{IO(r)}catch{}try{nG(o)}catch{}throw s}}}});function Dx(t){let ... L143: `}`)}}else process.stderr.write(`${l?"\r":""} baixando ${e}... ${m} MB${l?"":`
    High
    Same File Env Network Execution

    A single source file combines environment access, network access, and code or shell execution; review context before blocking.

    dist-bundle/bin/aluy.jsView on unpkg · L135
    8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var V8,X8,Dy=p(()=>{"use strict";V8="<<<FIM_DADO>>>",X8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as J8}from"node:crypto";function _y(t,e){let o=[...t,e];return o.length>Ty?o... L13: ... L23: L24: `)+q}}}]}var ms,$y,_C,Hm=p(()=>{"use strict";My();Zl();Ny();ms="room_post",$y="room_read",_C=["ask","inform","result","ack"]});function qm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var ef=p(()=>{"use strict"});function bD(t=globalThis.process?.env??{}){let e=fD(t[hD]),o=fD(t[gD]);return{maxConsecutiveLineRepeats:e!==void 0
    High
    Sandbox Evasion Gated Capability

    Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

    dist-bundle/bin/aluy.jsView on unpkg · L8
    8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var V8,X8,Dy=p(()=>{"use strict";V8="<<<FIM_DADO>>>",X8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as J8}from"node:crypto";function _y(t,e){let o=[...t,e];return o.length>Ty?o... L13: ... L23: L24: `)+q}}}]}var ms,$y,_C,Hm=p(()=>{"use strict";My();Zl();Ny();ms="room_post",$y="room_read",_C=["ask","inform","result","ack"]});function qm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var ef=p(()=>{"use strict"});function bD(t=globalThis.process?.env??{}){let e=fD(t[hD]),o=fD(t[gD]);return{maxConsecutiveLineRepeats:e!==void 0
    High
    Cloud Metadata Access

    Source reaches cloud instance metadata or link-local credential endpoints.

    dist-bundle/bin/aluy.jsView on unpkg · L8
    8Cross-file remote execution chain: dist-bundle/bin/aluy.js spawns dist-bundle/index.js; helper contains network access plus dynamic code execution. L8: ${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var V8,X8,Dy=p(()=>{"use strict";V8="<<<FIM_DADO>>>",X8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as J8}from"node:crypto";function _y(t,e){let o=[...t,e];return o.length>Ty?o... L13: ... L23: L24: `)+q}}}]}var ms,$y,_C,Hm=p(()=>{"use strict";My();Zl();Ny();ms="room_post",$y="room_read",_C=["ask","inform","result","ack"]});function qm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}…
    High
    Cross File Remote Execution Context

    Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

    dist-bundle/bin/aluy.jsView on unpkg · L8
    8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var V8,X8,Dy=p(()=>{"use strict";V8="<<<FIM_DADO>>>",X8="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as J8}from"node:crypto";function _y(t,e){let o=[...t,e];return o.length>Ty?o... L13: ... L23: L24: `)+q}}}]}var ms,$y,_C,Hm=p(()=>{"use strict";My();Zl();Ny();ms="room_post",$y="room_read",_C=["ask","inform","result","ack"]});function qm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var ef=p(()=>{"use strict"});function bD(t=globalThis.process?.env??{}){let e=fD(t[hD]),o=fD(t[gD]);return{maxConsecutiveLineRepeats:e!==void 0
    Medium
    Install Persistence

    Source writes installer persistence such as shell profile or service configuration.

    dist-bundle/bin/aluy.jsView on unpkg · L8
    dist-bundle/index.jsView file
    426Trigger-reachable chain: manifest.main -> dist-bundle/index.js L426: - Credencial S\xD3 no keychain do SO \u2014 nunca em texto em claro. L427: - Loop de agente + ferramentas nativas + controle de permiss\xE3o integrados.`;function Je(t,e,o={}){let n=`--${e}=`;for(let r=0;r<t.length;r++){let s=t[r];if(s===`--${e}`){let i=t... L428: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`),f({status:O,body:X,...H?{contentType:H}:{}})}),D.on("close",()=>{if(c)return;let X=Buffer.concat(B).toString("utf8")+(W?` ... L430: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`;f({status:O,body:ne,...H?{contentType:H}:{}});return}d(X)})}),S=()=>{g.destroy(),d(new Error("cancelado"))},w=setTimeout(()=>... L431: ${Zo(S)}`}}catch(h){let y=u?`o proxy n\xE3o respondeu em ${f}ms (timeout)`:h instanceof Error?h.message:String(h);return{ok:!1,display:l,observation:`headroom_retrieve: falha ao fa... L432: [arquivo truncado: lidos ${this.maxReadBytes} de ${s} bytes]`:n}async readFileMeta(e){let o=this.workspace.resolveInside(e),{content:n,truncated:r,binary:s}=await Vi(o,this.maxRead...
    Critical
    Trigger Reachable Dangerous Capability

    A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

    dist-bundle/index.jsView on unpkg · L426
    assets/mem0/aluy-mem0-server.pyView file
    •path = assets/mem0/aluy-mem0-server.py kind = build_helper sizeBytes = 20729 magicHex = [redacted]
    Medium
    Ships Build Helper

    Package ships non-JavaScript build or shell helper files.

    assets/mem0/aluy-mem0-server.pyView on unpkg

    Findings

    2 Critical5 High6 Medium5 Low
    CriticalCommand Output Exfiltrationdist-bundle/bin/aluy.js
    CriticalTrigger Reachable Dangerous Capabilitydist-bundle/index.js
    HighChild Processdist-bundle/bin/aluy.js
    HighSame File Env Network Executiondist-bundle/bin/aluy.js
    HighSandbox Evasion Gated Capabilitydist-bundle/bin/aluy.js
    HighCloud Metadata Accessdist-bundle/bin/aluy.js
    HighCross File Remote Execution Contextdist-bundle/bin/aluy.js
    MediumNetwork
    MediumEnvironment Vars
    MediumInstall Persistencedist-bundle/bin/aluy.js
    MediumProtestware
    MediumShips Build Helperassets/mem0/aluy-mem0-server.py
    MediumStructural Risk Force Deep Review
    LowFilesystem
    LowObfuscated
    LowHigh Entropy Strings
    LowUrl Strings
    LowNo License