@kryd/cli@0.19.0: Clean npm security report (Allow)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The manifest has no install lifecycle hook, and the inspected credential, network, process, and agent-file behavior is consistent with explicit Kryd CLI operations. The scanner’s credential-redirection and command-output exfiltration claims were not substantiated by the inspected source paths.

Static reason

One or more suspicious static signals were detected.

Trigger

A user invokes the CLI, such as login or project setup.

Impact

The inspected flows do not establish credential redirection to an unrelated recipient or unrequested agent control changes.

Mechanism

Login uses the configured dashboard and a state-checked localhost callback; API requests use the resolved API URL. Project setup writes a marked Kryd deployment section to AGENTS.md.

AI rationale

The manifest has no install lifecycle hook, and the inspected credential, network, process, and agent-file behavior is consistent with explicit Kryd CLI operations. The scanner’s credential-redirection and command-output exfiltration claims were not substantiated by the inspected source paths.

Evidence

package.jsondist/index.js

Network endpoints2

localhost:3000app.kryd.eu

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes dist/index.js as a CLI and defines no install lifecycle hook.
The API default is local; an API override comes from a CLI flag, environment setting, or saved configuration.
Browser login opens the resolved dashboard and receives its token through a state-checked localhost callback; the token is then saved for the selected API.
The targeted agent-file code adds or updates a marked Kryd deployment block, and its caller is the project setup or refresh flow.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 769 KB of source, external domains: 127.0.0.1, app.kryd.eu, docs.kryd.eu, git-scm.com, json-schema.org

Source & flagged code

5 flagged

dist/index.jsView file

16710// src/browser-login.ts L16711: import { spawn } from "node:child_process"; L16712: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16710

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: writeFileSync as writeFileSync3 writeFileSync writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 }); return { authorization: `Bearer ${token}`, ...accountHeader(token) }; writeFileSync(path, JSON.stringify(link, null, 2) + "\n"); writeFileSync(path, contents, { mode: 384 }); import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs"; - **AI:** an EU-hosted, OpenAI-compatible gateway with several models \u2014 \`kryd ai add\`; list the current models with \`kryd ai models\`. Don't add provider API keys.

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

16702await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id); L16703: process.stdout.write(`Revoked ${id}. Anything still using it now gets 401. L16704: `); ... L16710: // src/browser-login.ts L16711: import { spawn } from "node:child_process"; L16712: import { randomUUID } from "node:crypto"; L16713: import { createServer } from "node:http"; L16714: var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L16702

16702Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/index.js L16702: await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id); L16703: process.stdout.write(`Revoked ${id}. Anything still using it now gets 401. L16704: `); ... L16710: // src/browser-login.ts L16711: import { spawn } from "node:child_process"; L16712: import { randomUUID } from "node:crypto"; L16713: import { createServer } from "node:http"; L16714: var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:c...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L16702

package.jsonView file

19"type": "module", "bin": { "kryd": "dist/index.js" }, "files": [ "dist", "README.md", "LICENSE" ], "engines": { "node": ">=22"

Low

Suspicious Lifecycle Evidence

package.json exposes dist/index.js as a CLI and defines no install lifecycle hook.

package.jsonView on unpkg · L19

Source & flagged code

5 flagged · loading source

dist/index.jsView file

16710// src/browser-login.ts L16711: import { spawn } from "node:child_process"; L16712: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16710

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: writeFileSync as writeFileSync3 writeFileSync writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 }); return { authorization: `Bearer ${token}`, ...accountHeader(token) }; writeFileSync(path, JSON.stringify(link, null, 2) + "\n"); writeFileSync(path, contents, { mode: 384 }); import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs"; - **AI:** an EU-hosted, OpenAI-compatible gateway with several models \u2014 \`kryd ai add\`; list the current models with \`kryd ai models\`. Don't add provider API keys.

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

16702await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id); L16703: process.stdout.write(`Revoked ${id}. Anything still using it now gets 401. L16704: `); ... L16710: // src/browser-login.ts L16711: import { spawn } from "node:child_process"; L16712: import { randomUUID } from "node:crypto"; L16713: import { createServer } from "node:http"; L16714: var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:c...

Findings

4 High2 Medium6 Low

HighChild Processdist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowSuspicious Lifecycle Evidencepackage.json

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code