Loading npm security reports…

@inference-gateway/adl-cli@0.52.0: Suspicious npm security report | LPM Firewall

registry / @inference-gateway/adl-cli / 0.52.0

@inference-gateway/adl-cli@0.52.0

Scaffold complete A2A (Agent-to-Agent) projects from YAML Agent Definition Language (ADL) manifests. Thin npm wrapper around the native adl binary.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.68 KB of source, external domains: github.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-29json

2 "name": "@inference-gateway/adl-cli",

3 "version": "0.52.0",

4 "description": "Scaffold complete A2A (Agent-to-Agent) projects from YAML Agent Definition Language (ADL) manifests. Thin npm wrapper around the native adl binary.",

5 "bin": {

6 "adl": "bin/run.js"

7 },

8 "scripts": {

9 "postinstall": "node bin/install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 },

11 "files": [

12 "bin/run.js",

13 "bin/install.js",

14 "README.md",

15 "LICENSE"

16 ],

17 "keywords": [

18 "a2a",

19 "agent",

20 "agent-to-agent",

21 "adl",

22 "scaffold",

23 "scaffolding",

24 "generator",

25 "cli",

26 "inference-gateway"

27 ],

28 "homepage": "https://github.com/inference-gateway/adl-cli#readme",

29 "bugs": {

bin/run.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2"use strict";

4// Locates the native `adl` binary fetched by bin/install.js and execs it,

5// forwarding all arguments, stdio, and the exit code.

7const fs = require("fs");

8const path

bin/install.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4// Downloads the native `adl` binary that matches the host platform from the

5// GitHub release matching this package's version, and places it next to this

6// script so `bin/run.js` can exec it. Runs as an npm `postinstall` hook.

8const fs = require("fs");

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code