registry  /  @hiperplano/aluy-cli  /  1.0.0-rc.91

@hiperplano/aluy-cli@1.0.0-rc.91

Aluy CLI — TUI (Ink) + binário `aluy` + wiring. Consome @hiperplano/aluy-cli-core (engine portável). Credenciais só no keychain do SO.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established by static inspection. This is a user-invoked AI agent CLI with expected dual-use shell, file, memory, and network capabilities guarded by policy checks.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs the aluy CLI or imports the bundled entrypoint.
Impact
Can execute commands and edit files during requested agent workflows, but no unconsented malicious behavior was identified.
Mechanism
user-invoked agent CLI capabilities with permission gating
Rationale
Scanner findings are explained by the package's declared AI-agent CLI functionality; dangerous primitives are exposed as user-invoked tools with policy checks and loopback/product-aligned networking. There are no lifecycle hooks or confirmed covert exfiltration/persistence behaviors in the inspected files.
Evidence
package.jsondist-bundle/bin/aluy.jsdist-bundle/index.jsassets/mem0/aluy-mem0-server.pyREADME.md~/.aluy/memory~/.aluy/undo~/.aluy/todos
Network endpoints8
github.com/hiperplano/aluy-cli.gitgithub.com/hiperplano/aluy-cli/issuesgithub.com/hiperplano/aluy-cli#readmeraw.githubusercontent.com/hiperplano/aluy-cli/main/docs/aluy-wordmark-white.pngraw.githubusercontent.com/hiperplano/aluy-cli/main/docs/aluy-wordmark.pngwezterm.org127.0.0.1:11434127.0.0.1:11435

Decision evidence

public snapshot
AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • Bundled CLI contains agent tools for shell execution, file writes, memory storage, and network fetch/search.
  • Package includes loopback Mem0 HTTP helper that persists memory under ~/.aluy/memory.
Evidence against
  • package.json has no lifecycle scripts; only main and bin entrypoints.
  • Observed network targets are repo/docs URLs, loopback services, DuckDuckGo search, and aluy allowlist strings.
  • Source includes permission/risk gating for network, destructive shell commands, sensitive reads, and outside-workspace writes.
  • No confirmed install-time/import-time credential harvesting, external exfiltration, persistence, or cloud metadata credential access found.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Manifest
NoLicense
scanned 2 file(s), 1.91 MB of source, external domains: 127.0.0.1, api.aluy.app, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, broker.dev.aluy.example, claude.ai, console.anthropic.com, duckduckgo.com, generativelanguage.googleapis.com, github.com, ollama.com, openrouter.ai, registry.npmjs.org

Source & flagged code

9 flagged · loading source
dist-bundle/bin/aluy.jsView file
129${n.snippet}`.trimEnd());return[`Resultados de busca para "${t}" (DuckDuckGo):`,...o,"","(As URLs acima N\xC3O foram buscadas. Para abrir uma, use web_fetch \u2014 ela passar\xE1 n... L130: `)}var XW,JW,pR,QW,hR,op,yR=p(()=>{"use strict";Fr();tp();Rk();XW=8;JW=Object.freeze({type:"object",properties:{url:{type:"string",description:"OBRIGAT\xD3RIO. A URL http(s) a busc... L131: ... L135: ${t.trim()}`}}function CR(t,e,o=Su){let{older:n,recent:r}=ip(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[AR(e,n... L136: `),Su=4,rp=1500,sp=.4,np=48e3;Ci=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},xu=class{model;ke... L137: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ye(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function v6(t,e,o){let n... ... L141: `)}function U6(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var yO=p(()=>{"use strict"});var bO=p(()=>{"use strict";kp();QR();ZR();eO();tO();nO();aO();jm();fO();yO()... L142: `,r;try{r=sG(o,Ax.O_CREAT|Ax.O_EXCL|Ax.
Critical
Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist-bundle/bin/aluy.jsView on unpkg · L129
88L89: `):void 0}function G0(t,e,o){if(o===void 0)return e;let n=jv(t.model);return n===void 0?e:o(n)}var $0,B0,U0,vi,zv,j0,H0,eW,Kv,Jc,Yv=p(()=>{"use strict";bv();Hv();qv();ai();Bv();Wf(... L90:
High
Child Process

Package source references child process execution.

dist-bundle/bin/aluy.jsView on unpkg · L88
135${t.trim()}`}}function CR(t,e,o=Su){let{older:n,recent:r}=ip(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[AR(e,n... L136: `),Su=4,rp=1500,sp=.4,np=48e3;Ci=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},xu=class{model;ke... L137: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ye(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function v6(t,e,o){let n... ... L141: `)}function U6(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var yO=p(()=>{"use strict"});var bO=p(()=>{"use strict";kp();QR();ZR();eO();tO();nO();aO();jm();fO();yO()... L142: `,r;try{r=sG(o,Ax.O_CREAT|Ax.O_EXCL|Ax.O_WRONLY,mG),iG(r,n),HO(r),r=void 0,cG(o,this.file)}catch(s){if(r!==void 0)try{HO(r)}catch{}try{uG(o)}catch{}throw s}}}});function _x(t){let ... L143: `}`)}}else process.stderr.write(`${l?"\r":""} baixando ${e}... ${m} MB${l?"":`
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-bundle/bin/aluy.jsView on unpkg · L135
8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var oH,nH,_y=p(()=>{"use strict";oH="<<<FIM_DADO>>>",nH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as rH}from"node:crypto";function Oy(t,e){let o=[...t,e];return o.length>Ry?o... L13: ... L23: L24: `)+q}}}]}var gs,Uy,FC,Xm=p(()=>{"use strict";Py();sc();By();gs="room_post",Uy="room_read",FC=["ask","inform","result","ack"]});function Jm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var cf=p(()=>{"use strict"});function ED(t=globalThis.process?.env??{}){let e=vD(t[xD]),o=vD(t[SD]);return{maxConsecutiveLineRepeats:e!==void 0
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist-bundle/bin/aluy.jsView on unpkg · L8
8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var oH,nH,_y=p(()=>{"use strict";oH="<<<FIM_DADO>>>",nH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as rH}from"node:crypto";function Oy(t,e){let o=[...t,e];return o.length>Ry?o... L13: ... L23: L24: `)+q}}}]}var gs,Uy,FC,Xm=p(()=>{"use strict";Py();sc();By();gs="room_post",Uy="room_read",FC=["ask","inform","result","ack"]});function Jm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var cf=p(()=>{"use strict"});function ED(t=globalThis.process?.env??{}){let e=vD(t[xD]),o=vD(t[SD]);return{maxConsecutiveLineRepeats:e!==void 0
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist-bundle/bin/aluy.jsView on unpkg · L8
8Cross-file remote execution chain: dist-bundle/bin/aluy.js spawns dist-bundle/index.js; helper contains network access plus dynamic code execution. L8: ${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var oH,nH,_y=p(()=>{"use strict";oH="<<<FIM_DADO>>>",nH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as rH}from"node:crypto";function Oy(t,e){let o=[...t,e];return o.length>Ry?o... L13: ... L23: L24: `)+q}}}]}var gs,Uy,FC,Xm=p(()=>{"use strict";Py();sc();By();gs="room_post",Uy="room_read",FC=["ask","inform","result","ack"]});function Jm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}…
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-bundle/bin/aluy.jsView on unpkg · L8
8${n}`,display:o}}case"text":return{ok:!0,observation:`O usu\xE1rio respondeu \xE0 pergunta "${t.question}": L9: ${e.text}`,display:o};case"unavailable":return{ok:!1,observation:`N\xE3o foi poss\xEDvel PERGUNTAR ao usu\xE1rio: ${e.reason}. Isto N\xC3O \xE9 um erro t\xE9cnico nem motivo para r... L10: `).map(s=>s.trim()===""?"":` ${s}`).join(` L11: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L12: `)}var oH,nH,_y=p(()=>{"use strict";oH="<<<FIM_DADO>>>",nH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as rH}from"node:crypto";function Oy(t,e){let o=[...t,e];return o.length>Ry?o... L13: ... L23: L24: `)+q}}}]}var gs,Uy,FC,Xm=p(()=>{"use strict";Py();sc();By();gs="room_post",Uy="room_read",FC=["ask","inform","result","ack"]});function Jm(t,e,o){for(let n of t.rules)if(n.tool===e... L25: `);let s=o.indexOf(` ... L30: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L31: `)}:null}var cf=p(()=>{"use strict"});function ED(t=globalThis.process?.env??{}){let e=vD(t[xD]),o=vD(t[SD]);return{maxConsecutiveLineRepeats:e!==void 0
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist-bundle/bin/aluy.jsView on unpkg · L8
dist-bundle/index.jsView file
426Trigger-reachable chain: manifest.main -> dist-bundle/index.js L426: - Credencial S\xD3 no keychain do SO \u2014 nunca em texto em claro. L427: - Loop de agente + ferramentas nativas + controle de permiss\xE3o integrados.`;function Ze(t,e,o={}){let n=`--${e}=`;for(let r=0;r<t.length;r++){let s=t[r];if(s===`--${e}`){let i=t... L428: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`),f({status:O,body:X,...H?{contentType:H}:{}})}),D.on("close",()=>{if(c)return;let X=Buffer.concat(B).toString("utf8")+(W?` ... L430: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`;f({status:O,body:ne,...H?{contentType:H}:{}});return}d(X)})}),E=()=>{g.destroy(),d(new Error("cancelado"))},w=setTimeout(()=>... L431: ${en(E)}`}}catch(h){let y=u?`o proxy n\xE3o respondeu em ${f}ms (timeout)`:h instanceof Error?h.message:String(h);return{ok:!1,display:l,observation:`headroom_retrieve: falha ao fa... L432: [arquivo truncado: lidos ${this.maxReadBytes} de ${s} bytes]`:n}async readFileMeta(e){let o=this.workspace.resolveInside(e),{content:n,truncated:r,binary:s}=await ta(o,this.maxRead...
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-bundle/index.jsView on unpkg · L426
assets/mem0/aluy-mem0-server.pyView file
•path = assets/mem0/aluy-mem0-server.py kind = build_helper sizeBytes = 20729 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/mem0/aluy-mem0-server.pyView on unpkg

Findings

2 Critical5 High6 Medium5 Low
CriticalCommand Output Exfiltrationdist-bundle/bin/aluy.js
CriticalTrigger Reachable Dangerous Capabilitydist-bundle/index.js
HighChild Processdist-bundle/bin/aluy.js
HighSame File Env Network Executiondist-bundle/bin/aluy.js
HighSandbox Evasion Gated Capabilitydist-bundle/bin/aluy.js
HighCloud Metadata Accessdist-bundle/bin/aluy.js
HighCross File Remote Execution Contextdist-bundle/bin/aluy.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist-bundle/bin/aluy.js
MediumProtestware
MediumShips Build Helperassets/mem0/aluy-mem0-server.py
MediumStructural Risk Force Deep Review
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License