registry  /  @hiperplano/aluy-cli  /  1.0.0-rc.98

@hiperplano/aluy-cli@1.0.0-rc.98

Aluy CLI — TUI (Ink) + binário `aluy` + wiring. Consome @hiperplano/aluy-cli-core (engine portável). Credenciais só no keychain do SO.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked AI terminal agent with broad but documented capabilities guarded by its own permission model and package-owned ~/.aluy state.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs aluy, aluy onboard, aluy bootstrap, or interactive agent commands.
Impact
Can affect local files/commands when the user invokes the agent or enables --yolo, but no hidden install-time execution, credential exfiltration, or unconsented foreign agent control-surface mutation was found.
Mechanism
Documented AI agent CLI with permission-gated file, shell, web, MCP, memory, and sidecar features.
Rationale
Scanner hits reflect the expected capabilities of a documented AI agent CLI, not hidden install/import behavior. Source inspection found no lifecycle hooks, no concrete exfiltration path, and no unconsented mutation of foreign AI-agent control surfaces.
Evidence
package.jsonREADME.mddist-bundle/bin/aluy.jsdist-bundle/index.jsassets/mem0/aluy-mem0-server.py~/.aluy/config.json~/.aluy/providers.json~/.aluy/mcp.json.mcp.json~/.codex/config.toml~/.aluy/memory~/.aluy/logsALUY.md.aluy/
Network endpoints10
api.aluy.app/api/v1api.openai.com/v1api.anthropic.comopenrouter.ai/api/v1duckduckgo.comhtml.duckduckgo.com/html/registry.npmjs.org/${YN.replace(127.0.0.1:11434/v1127.0.0.1:11435/health127.0.0.1:49876/callback

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no npm lifecycle scripts; only main and aluy bin entrypoints.
    • README documents an explicit terminal AI agent with file, command, web, MCP, memory, login, onboard, bootstrap, and --yolo features.
    • dist-bundle/bin/aluy.js permission engine asks/denies for destructive commands, network shell commands, package execution, startup files, outside-workspace writes, and sensitive reads.
    • Credential handling uses @napi-rs/keyring service aluy-cli-local and env fallbacks, not plaintext harvesting.
    • Network endpoints are user-invoked provider/product/local endpoints: api.aluy.app, LLM providers, DuckDuckGo, OAuth, registry.npmjs.org, 127.0.0.1 services.
    • Sidecar spawn and ~/.aluy writes are package-owned runtime/bootstrap behavior, not install-time mutation of foreign agent control surfaces.
    Behavioral surface
    Source
    ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork
    Supply chain
    HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
    Manifest
    NoLicense
    scanned 2 file(s), 1.94 MB of source, external domains: 127.0.0.1, api.aluy.app, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.telegram.org, api.x.ai, auth.openai.com, broker.dev.aluy.example, claude.ai, console.anthropic.com, duckduckgo.com, generativelanguage.googleapis.com, github.com, ollama.com, openrouter.ai, registry.npmjs.org

    Source & flagged code

    9 flagged · loading source
    dist-bundle/bin/aluy.jsView file
    131${n.snippet}`.trimEnd());return[`Resultados de busca para "${t}" (DuckDuckGo):`,...o,"","(As URLs acima N\xC3O foram buscadas. Para abrir uma, use web_fetch \u2014 ela passar\xE1 n... L132: `)}var j6,H6,qR,q6,WR,dp,zR=p(()=>{"use strict";Fr();up();qk();j6=8;H6=Object.freeze({type:"object",properties:{url:{type:"string",description:"OBRIGAT\xD3RIO. A URL http(s) a busc... L133: ... L137: ${t.trim()}`}}function tO(t,e,o=Mu){let{older:n,recent:r}=hp(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[eO(e,n... L138: `),Mu=4,fp=1500,pp=.4,mp=48e3;Fi=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},Ou=class{model;ke... L139: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ge(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function uG(t,e,o){let n... ... L143: `)}function OG(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var zO=p(()=>{"use strict"});var KO=p(()=>{"use strict";_p();TO();DO();_O();RO();MO();FO();Qm();HO();zO()... L144: `,r;try{r=XG(o,$x.O_CREAT|$x.O_EXCL|$x.
    Critical
    Command Output Exfiltration

    Source executes local commands and sends command output to an external endpoint.

    dist-bundle/bin/aluy.jsView on unpkg · L131
    90L91: `):void 0}function k_(t,e,o){if(o===void 0)return e;let n=ek(t.model);return n===void 0?e:o(n)}var f_,p_,h_,_i,sk,g_,y_,GW,ik,au,ak=p(()=>{"use strict";Ov();tk();ok();yi();Qv();Zf(... L92:
    High
    Child Process

    Package source references child process execution.

    dist-bundle/bin/aluy.jsView on unpkg · L90
    137${t.trim()}`}}function tO(t,e,o=Mu){let{older:n,recent:r}=hp(t,o);if(n.length===0)return{history:t,stats:{turnsBefore:t.length,turnsAfter:t.length,summarizedTurns:0}};let s=[eO(e,n... L138: `),Mu=4,fp=1500,pp=.4,mp=48e3;Fi=class extends Error{constructor(){super("hist\xF3rico curto demais \u2014 nada a compactar."),this.name="NothingToCompactError"}},Ou=class{model;ke... L139: `;case"t":return" ";case"r":return"\r";case'"':return'"';case"\\":return"\\";default:throw new ge(`config.toml:${e}: escape n\xE3o suportado "\\${i}".`)}})}function uG(t,e,o){let n... ... L143: `)}function OG(t,e){return t.length<=e?t:t.slice(0,e-1).trimEnd()+"\u2026"}var zO=p(()=>{"use strict"});var KO=p(()=>{"use strict";_p();TO();DO();_O();RO();MO();FO();Qm();HO();zO()... L144: `,r;try{r=XG(o,$x.O_CREAT|$x.O_EXCL|$x.O_WRONLY,n9),JG(r,n),yM(r),r=void 0,e9(o,this.file)}catch(s){if(r!==void 0)try{yM(r)}catch{}try{t9(o)}catch{}throw s}}}});function Hx(t){let ... L145: `}`)}}else process.stderr.write(`${l?"\r":""} baixando ${e}... ${m} MB${l?"":`
    High
    Same File Env Network Execution

    A single source file combines environment access, network access, and code or shell execution; review context before blocking.

    dist-bundle/bin/aluy.jsView on unpkg · L137
    10${o.join(` L11: `)}`}async function RH(t,e){if(!e.capabilities)return{ok:!1,observation:"capabilities: indispon\xEDvel nesta sess\xE3o (sem porta de capacidades)."};let o=t.filter,n=typeof o=="str... L12: `).map(s=>s.trim()===""?"":` ${s}`).join(` L13: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L14: `)}var zH,KH,Hy=p(()=>{"use strict";zH="<<<FIM_DADO>>>",KH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as YH}from"node:crypto";function Wy(t,e){let o=[...t,e];return o.length>qy?o... L15: ... L25: L26: `)+j}}}]}var ys,Zy,nT,lf=p(()=>{"use strict";Ky();pc();Qy();ys="room_post",Zy="room_read",nT=["ask","inform","result","ack"]});function cf(t,e,o){for(let n of t.rules)if(n.tool===e... L27: `);let s=o.indexOf(` ... L32: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L33: `)}:null}var kf=p(()=>{"use strict"});function zT(t=globalThis.process?.env??{}){let e=jT(t[qT]),o=jT(t[WT]);return{maxConsecutiveLineRepeats:e!==void 0?Math.max(3,e):25,maxCycleLe... L34: ${s}`:(r+s).trim()}function XD(t,e){let o=Math.min(t.lengt
    High
    Sandbox Evasion Gated Capability

    Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

    dist-bundle/bin/aluy.jsView on unpkg · L10
    10${o.join(` L11: `)}`}async function RH(t,e){if(!e.capabilities)return{ok:!1,observation:"capabilities: indispon\xEDvel nesta sess\xE3o (sem porta de capacidades)."};let o=t.filter,n=typeof o=="str... L12: `).map(s=>s.trim()===""?"":` ${s}`).join(` L13: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L14: `)}var zH,KH,Hy=p(()=>{"use strict";zH="<<<FIM_DADO>>>",KH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as YH}from"node:crypto";function Wy(t,e){let o=[...t,e];return o.length>qy?o... L15: ... L25: L26: `)+j}}}]}var ys,Zy,nT,lf=p(()=>{"use strict";Ky();pc();Qy();ys="room_post",Zy="room_read",nT=["ask","inform","result","ack"]});function cf(t,e,o){for(let n of t.rules)if(n.tool===e... L27: `);let s=o.indexOf(` ... L32: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L33: `)}:null}var kf=p(()=>{"use strict"});function zT(t=globalThis.process?.env??{}){let e=jT(t[qT]),o=jT(t[WT]);return{maxConsecutiveLineRepeats:e!==void 0?Math.max(3,e):25,maxCycleLe... L34: ${s}`:(r+s).trim()}function XD(t,e){let o=Math.min(t.lengt
    High
    Cloud Metadata Access

    Source reaches cloud instance metadata or link-local credential endpoints.

    dist-bundle/bin/aluy.jsView on unpkg · L10
    10Cross-file remote execution chain: dist-bundle/bin/aluy.js spawns dist-bundle/index.js; helper contains network access plus dynamic code execution. L10: ${o.join(` L11: `)}`}async function RH(t,e){if(!e.capabilities)return{ok:!1,observation:"capabilities: indispon\xEDvel nesta sess\xE3o (sem porta de capacidades)."};let o=t.filter,n=typeof o=="str... L12: `).map(s=>s.trim()===""?"":` ${s}`).join(` L13: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L14: `)}var zH,KH,Hy=p(()=>{"use strict";zH="<<<FIM_DADO>>>",KH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as YH}from"node:crypto";function Wy(t,e){let o=[...t,e];return o.length>qy?o... L15: ... L25: L26: `)+j}}}]}var ys,Zy,nT,lf=p(()=>{"use strict";Ky();pc();Qy();ys="room_post",Zy="room_read",nT=["ask","inform","result","ack"]});function cf(t,e,o){for(let n of t.rules)if(n.tool===e... L27: `);let s=o.indexOf(` ... L32: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L33: `)}:null}var kf=p(()=>{"use strict"});function zT(t=globalThis.process?.env??{}){let e=jT(t[qT]),o…
    High
    Cross File Remote Execution Context

    Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

    dist-bundle/bin/aluy.jsView on unpkg · L10
    10${o.join(` L11: `)}`}async function RH(t,e){if(!e.capabilities)return{ok:!1,observation:"capabilities: indispon\xEDvel nesta sess\xE3o (sem porta de capacidades)."};let o=t.filter,n=typeof o=="str... L12: `).map(s=>s.trim()===""?"":` ${s}`).join(` L13: `);return[`<<<DADO_NAO_CONFIAVEL origem=${o}>>>`,r,"<<<FIM_DADO>>>"].join(` L14: `)}var zH,KH,Hy=p(()=>{"use strict";zH="<<<FIM_DADO>>>",KH="DADO_NAO_CONFIAVEL>>>"});import{randomBytes as YH}from"node:crypto";function Wy(t,e){let o=[...t,e];return o.length>qy?o... L15: ... L25: L26: `)+j}}}]}var ys,Zy,nT,lf=p(()=>{"use strict";Ky();pc();Qy();ys="room_post",Zy="room_read",nT=["ask","inform","result","ack"]});function cf(t,e,o){for(let n of t.rules)if(n.tool===e... L27: `);let s=o.indexOf(` ... L32: `)){if(r===""||r.startsWith(":"))continue;let s=r.indexOf(":"),i=s===-1?r:r.slice(0,s),a=s===-1?"":r.slice(s+1);a.startsWith(" ")&&(a=a.slice(1)),i==="event"?(e=a,n=!0):i==="data"&... L33: `)}:null}var kf=p(()=>{"use strict"});function zT(t=globalThis.process?.env??{}){let e=jT(t[qT]),o=jT(t[WT]);return{maxConsecutiveLineRepeats:e!==void 0?Math.max(3,e):25,maxCycleLe... L34: ${s}`:(r+s).trim()}function XD(t,e){let o=Math.min(t.lengt
    Medium
    Install Persistence

    Source writes installer persistence such as shell profile or service configuration.

    dist-bundle/bin/aluy.jsView on unpkg · L10
    dist-bundle/index.jsView file
    428Trigger-reachable chain: manifest.main -> dist-bundle/index.js L428: - Credencial S\xD3 no keychain do SO \u2014 nunca em texto em claro. L429: - Loop de agente + ferramentas nativas + controle de permiss\xE3o integrados.`;function Qe(t,e,o={}){let n=`--${e}=`;for(let r=0;r<t.length;r++){let s=t[r];if(s===`--${e}`){let i=t... L430: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`),m({status:_,body:X,...U?{contentType:U}:{}})}),w.on("close",()=>{if(c)return;let X=Buffer.concat($).toString("utf8")+(I?` ... L432: \u2026[truncado: corpo maior que ${e.maxBytes} bytes]`;m({status:_,body:oe,...U?{contentType:U}:{}});return}d(X)})}),E=()=>{h.destroy(),d(new Error("cancelado"))},x=setTimeout(()=>... L433: ${tn(E)}`}}catch(g){let y=u?`o proxy n\xE3o respondeu em ${m}ms (timeout)`:g instanceof Error?g.message:String(g);return{ok:!1,display:l,observation:`headroom_retrieve: falha ao fa... L434: [arquivo truncado: lidos ${this.maxReadBytes} de ${s} bytes]`:n}async readFileMeta(e){let o=this.workspace.resolveInside(e),{content:n,truncated:r,binary:s}=await ua(o,this.maxRead...
    Critical
    Trigger Reachable Dangerous Capability

    A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

    dist-bundle/index.jsView on unpkg · L428
    assets/mem0/aluy-mem0-server.pyView file
    •path = assets/mem0/aluy-mem0-server.py kind = build_helper sizeBytes = 20729 magicHex = [redacted]
    Medium
    Ships Build Helper

    Package ships non-JavaScript build or shell helper files.

    assets/mem0/aluy-mem0-server.pyView on unpkg

    Findings

    2 Critical5 High6 Medium5 Low
    CriticalCommand Output Exfiltrationdist-bundle/bin/aluy.js
    CriticalTrigger Reachable Dangerous Capabilitydist-bundle/index.js
    HighChild Processdist-bundle/bin/aluy.js
    HighSame File Env Network Executiondist-bundle/bin/aluy.js
    HighSandbox Evasion Gated Capabilitydist-bundle/bin/aluy.js
    HighCloud Metadata Accessdist-bundle/bin/aluy.js
    HighCross File Remote Execution Contextdist-bundle/bin/aluy.js
    MediumNetwork
    MediumEnvironment Vars
    MediumInstall Persistencedist-bundle/bin/aluy.js
    MediumProtestware
    MediumShips Build Helperassets/mem0/aluy-mem0-server.py
    MediumStructural Risk Force Deep Review
    LowFilesystem
    LowObfuscated
    LowHigh Entropy Strings
    LowUrl Strings
    LowNo License