@kerno/cli@0.1.24
Kerno CLI - Local backend validation for AI-generated code, against your real stack.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete remote-code-execution supply-chain risk, but source confines it to an explicit first-party agent setup command and does not show malicious install-time behavior or foreign AI-agent configuration mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs kerno init when the agent is absent, outdated, or force-updated.
Impact
A compromised or substituted GitHub-hosted installer can execute arbitrary code as the CLI user.
Mechanism
Remote shell-script download followed by direct execution.
AI rationale
This is a concrete remote-code-execution supply-chain risk, but source confines it to an explicit first-party agent setup command and does not show malicious install-time behavior or foreign AI-agent configuration mutation.
Evidence
package.jsonpostinstall.cjscli.js
Network endpoints2
raw.githubusercontent.com/kernoio/kerno-agent-runtimes/2026.8.7.1/install.shraw.githubusercontent.com/kernoio/kerno-agent-runtimes/2026.8.7.1/install.ps1
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- cli.js downloads a shell/PowerShell installer from raw.githubusercontent.com.
- cli.js writes the response to a temp script and executes it with bash or PowerShell.
- No hash, signature, or other integrity verification precedes execution.
Evidence against
- package.json postinstall only invokes postinstall.cjs.
- postinstall.cjs only reads package.json and prints a banner.
- Remote installer execution is reached through explicit kerno init/agent setup, not install time.
- MCP integration is displayed as instructions; no Claude/Cursor config is written.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli.jsView file
318"use strict";
L319: if (process.env.NODE_ENV !== "production") {
L320: (function() {
...
L546: isMounted: ["isMounted", "Instead, make sure to clean up subscriptions and pending requests in componentWillUnmount to prevent memory leaks."],
L547: replaceState: ["replaceState", "Refactor your code to use setState instead (see https://github.com/facebook/react/issues/3236)."]
L548: };
...
L2023: var thenable = {
L2024: then: function(resolve4, reject) {
L2025: wasAwaited = true;
...
L2211: ];
L2212: if (process.platform !== "win32") {
L2213: module.exports.push(
Findings
4 Critical5 High5 Medium5 Low
CriticalCommand Output Exfiltrationcli.js
CriticalRemote Asset Decode Executecli.js
CriticalTrigger Reachable Dangerous Capabilitycli.js
CriticalPrevious Version Dangerous Deltacli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli.js
HighShellcli.js
HighSame File Env Network Executioncli.js
HighSemantic Analysis Limitedcli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumOversized Source Filecli.js
MediumOversized Cli Entrypoint
Affected versions and remediation
This report applies to @kerno/cli@0.1.24.
See all versions of @kerno/cli for other recorded verdicts.
- Review the evidence and your use of @kerno/cli@0.1.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.