registry / @kryd/cli / 0.21.0

@kryd/cli@0.21.0

Kryd CLI — git push → live on the European cloud for your AI: SSL, managed Postgres & object storage, and an EU-hosted AI gateway. Your code and model calls stay in the EU. Beta: sign up at https://kryd.eu/beta

AI Security Review

scanned 8h ago · by lpm-firewall-ai

Source review found no install-time behavior or concrete attack chain. The static similarities and process/network matches are not proof of malicious behavior; inspected examples align with CLI login, Git operations, and project-scoped setup.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The user runs the CLI or invokes a project scaffolding command.

Impact

No confirmed credential theft, command-output disclosure, or unconsented broad agent control change was established.

Mechanism

The CLI opens a Kryd login URL in the browser, uses Git for repository operations, and writes a managed Kryd guidance block during scaffolding.

AI rationale

Evidence

AGENTS.mdCLAUDE.md

Network endpoints1

app.kryd.eu

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a CLI entrypoint and has no install lifecycle hook.
The CLI uses KRYD_API_URL or saved configuration before falling back to its Kryd API default.
Agent guidance is written by a project scaffolding flow and modifies only its Kryd-marked block.
The prepared commander dependency exports ordinary command parser APIs.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 790 KB of source, external domains: 127.0.0.1, app.kryd.eu, docs.kryd.eu, git-scm.com, json-schema.org

Source & flagged code

6 flagged

dist/index.jsView file

16899// src/browser-login.ts L16900: import { spawn } from "node:child_process"; L16901: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16899

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: writeFileSync as writeFileSync3 writeFileSync writeFileSync(path, JSON.stringify(config2, null, 2) + "\n", { mode: 384 }); return { authorization: `Bearer ${token}`, ...accountHeader(token), ...cliVersionHeader() }; writeFileSync(path, JSON.stringify(link, null, 2) + "\n"); writeFileSync(path, contents, { mode: 384 }); import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs"; - **AI:** an EU-hosted, OpenAI-compatible gateway with several models \u2014 \`kryd ai add\`; list the current models with \`kryd ai models\`. Don't add provider API keys.

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

16891await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id); L16892: process.stdout.write(`Revoked ${id}. Anything still using it now gets 401. L16893: `); ... L16899: // src/browser-login.ts L16900: import { spawn } from "node:child_process"; L16901: import { randomUUID } from "node:crypto"; L16902: import { createServer } from "node:http"; L16903: var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L16891

16891Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/index.js L16891: await revokeDeployToken(resolveApiUrl(opts.apiUrl), token, id); L16892: process.stdout.write(`Revoked ${id}. Anything still using it now gets 401. L16893: `); ... L16899: // src/browser-login.ts L16900: import { spawn } from "node:child_process"; L16901: import { randomUUID } from "node:crypto"; L16902: import { createServer } from "node:http"; L16903: var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>Kryd CLI</title></head><body style="font-family:system-ui,-apple-system,sans-serif;text-align:c...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L16891

•matchType = normalized_sha256 matchedPackage = @kryd/cli@0.20.1 matchedPath = dist/index.js matchedIdentity = npm:QGtyeWQvY2xp:0.20.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a8d63fba2bf66b89 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kryd/cli@0.20.1 matchedPath = dist/index.js matchedIdentity = npm:QGtyeWQvY2xp:0.20.1 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.jsView file

16899// src/browser-login.ts L16900: import { spawn } from "node:child_process"; L16901: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16899

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

Findings

6 High2 Medium5 Low

HighChild Processdist/index.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Fingerprint Signaturedist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @kryd/cli@0.21.0.

See all versions of @kryd/cli for other recorded verdicts.

Review the evidence and your use of @kryd/cli@0.21.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 19:33:40.319Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.