registry / Credential exfiltration / @kryd/cli
@kryd/cli
Kryd CLI — git push → live on the European cloud for your AI: SSL, managed Postgres & object storage, and an EU-hosted AI gateway. Your code and model calls stay in the EU. Beta: sign up at https://kryd.eu/beta
This report shows the evidence for @kryd/cli@0.20.1. 1 of 19 known versions is blocked or flagged. The newest version, 0.21.0, is allowed. See all versions.
AI Security Review
scanned 9h ago · by lpm-firewall-aiThe manifest makes the affected runtime code the package's executable entrypoint. Source confirms a browser-login path that can send the newly issued service credential to the package-selected loopback default without recipient-specific consent.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs browser login and the callback supplies a token without an API URL, with no API URL override configured.
Impact
A service listening on the local endpoint can receive the user's Kryd token.
Mechanism
The CLI stores the token with the loopback URL and sends it as a Bearer credential to that URL's account lookup endpoint.
Attack narrative
The published command defaults its API destination to a local HTTP endpoint. In the browser login flow, the returned API URL is optional; when absent, the CLI saves the issued token with that default and uses it for an authenticated account lookup. This exposes the token to any service listening on that local endpoint.
AI rationale
The manifest makes the affected runtime code the package's executable entrypoint. Source confirms a browser-login path that can send the newly issued service credential to the package-selected loopback default without recipient-specific consent.
Evidence
package.jsondist/index.js~/.kryd/config.json
Network endpoints2
localhost:3000app.kryd.eu
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes dist/index.js as the kryd command.
- When no API URL is provided by a flag, environment variable, or saved configuration, the CLI selects http://localhost:3000.
- Browser login receives a token and treats the returned API URL as optional.
- Login saves the token using the returned API URL or the fallback URL, then sends it through account setup using that same URL.
- The account lookup sends the token as a Bearer authorization value to the selected URL's /me endpoint.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcedist/index.jsView file
16837// src/browser-login.ts
L16838: import { spawn } from "node:child_process";
L16839: import { randomUUID } from "node:crypto";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
writeFileSync as writeFileSync3
writeFileSync
writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 });
return { authorization: `Bearer ${token}`, ...accountHeader(token), ...cliVersionHeader() };
writeFileSync(path, JSON.stringify(link, null, 2) + "\n");
writeFileSync(path, contents, { mode: 384 });
import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
- **AI:** an EU-hosted, OpenAI-compatible gateway with several models \u2014 \`kryd ai add\`; list the current models with \`kryd ai models\`. Don't add provider API keys.
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg16829await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id);
L16830: process.stdout.write(`Revoked ${id}. Anything still using it now gets 401.
L16831: `);
...
L16837: // src/browser-login.ts
L16838: import { spawn } from "node:child_process";
L16839: import { randomUUID } from "node:crypto";
L16840: import { createServer } from "node:http";
L16841: var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:c...
Findings
5 High2 Medium5 Low
HighChild Processdist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kryd/cli@0.20.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @kryd/cli@0.20.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.