registry  /  @itznexus/itznexus-cli  /  1.22.0

@itznexus/itznexus-cli@1.22.0

ITzNexus CLI: operational commands for ITzWorking

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. Risky primitives are user-invoked CLI behavior for ITzNexus API operations, package self-update, and optional project context file creation.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs the itznexus CLI or explicit project context commands.
Impact
Can update this CLI globally during runtime and can write a managed CLAUDE.md in the current project only when requested by a project command.
Mechanism
API client, same-package auto-update, guarded CLAUDE.md writer
Rationale
The scanner-highlighted child_process and network behavior is package-aligned and runtime/user-invoked: same-package update checks and ITzNexus API calls. The CLAUDE.md writer is a guarded project command, not unconsented lifecycle mutation of a foreign agent surface.
Evidence
package.jsondist/index.jsdist/lib/auto-update.jsdist/lib/api.jsdist/lib/config.jsdist/lib/project-context.jsdist/commands/api/projects.js~/.itznexus/config.json~/.itznexus/last-update-checkCLAUDE.md
Network endpoints2
api.itznex.usnpm registry via npm view @itznexus/itznexus-cli version

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json prepare is only husky dev hook and published files are dist-only; no install/postinstall lifecycle in package.
    • dist/index.js calls checkForUpdates only when the CLI is invoked, not at install/import time.
    • dist/lib/auto-update.js runs npm view/install only for the same package name, rate-limited via ~/.itznexus/last-update-check.
    • dist/lib/project-context.js writes CLAUDE.md only from project subcommands and refuses hand-written CLAUDE.md unless --force is passed.
    • dist/lib/api.js sends requests to configured ITzNexus API with x-api-key auth; endpoints are package-aligned.
    • No credential harvesting, obfuscated payloads, persistence hooks, destructive actions, or foreign agent control-surface lifecycle writes found.
    Behavioral surface
    Source
    ChildProcessEnvironmentVarsFilesystemNetworkShell
    Supply chain
    HighEntropyStringsUrlStrings
    Manifest
    NoLicense
    scanned 42 file(s), 273 KB of source, external domains: api.itznex.us, github.com, www.upwork.com

    Source & flagged code

    3 flagged · loading source
    dist/lib/auto-update.jsView file
    3import os from "node:os"; L4: import { execSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";
    High
    Child Process

    Package source references child process execution.

    dist/lib/auto-update.jsView on unpkg · L3
    59try { L60: execSync(`npm install -g ${PKG_NAME}@latest`, { L61: timeout: 60_000,
    High
    Runtime Package Install

    Package source invokes a package manager install command at runtime.

    dist/lib/auto-update.jsView on unpkg · L59
    dist/commands/api/projects.jsView file
    •matchType = previous_version_dangerous_delta matchedPackage = @itznexus/itznexus-cli@1.19.1 matchedIdentity = npm:QGl0em5leHVzL2l0em5leHVzLWNsaQ:1.19.1 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file
    Critical
    Previous Version Dangerous Delta

    This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

    dist/commands/api/projects.jsView on unpkg

    Findings

    1 Critical3 High3 Medium6 Low
    CriticalPrevious Version Dangerous Deltadist/commands/api/projects.js
    HighChild Processdist/lib/auto-update.js
    HighShell
    HighRuntime Package Installdist/lib/auto-update.js
    MediumNetwork
    MediumEnvironment Vars
    MediumStructural Risk Force Deep Review
    LowNon Install Lifecycle Scripts
    LowScripts Present
    LowFilesystem
    LowHigh Entropy Strings
    LowUrl Strings
    LowNo License