registry / @nalvietnam/avatar-cli / 3.17.3

@nalvietnam/avatar-cli@3.17.3

⚠ Under review

AI harness CLI for NAL Vietnam engineering

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 4 file(s), 191 KB of source, external domains: ai.nal.vn, api.anthropic.com, cli.github.com, github.com, qpdbkewtpkkbcrptnlos.supabase.co, www.npmjs.com

Source & flagged code

7 flagged

package.jsonView file

Lines 10-50json

10 "bin",

11 "dist",

12 "src/templates",

13 "src/hooks",

14 "README.md"

15 ],

16 "engines": {

17 "node": ">=18.17.0"

18 },

19 "scripts": {

20 "build": "tsup",

21 "dev": "tsup --watch",

22 "test": "vitest run --passWithNoTests --exclude 'test/integration/**'",

23 "test:watch": "vitest --exclude 'test/integration/**'",

24 "test:e2e": "npm run build && vitest run --passWithNoTests test/integration",

25 "test:all": "npm run build && vitest run --passWithNoTests",

26 "lint": "biome check src test",

27 "format": "biome format --write src test",

28 "typecheck": "tsc --noEmit",

29 "prepublishOnly": "npm run lint && npm run typecheck && npm run build && npm run test:all",

30 "postinstall": "node ./bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "dependencies": {

33 "@inquirer/prompts": "^8.5.2",

34 "@napi-rs/keyring": "^1.1.0",

35 "boxen": "^8.0.0",

36 "chalk": "^5.3.0",

37 "cli-highlight": "^2.1.11",

38 "cli-table3": "^0.6.3",

39 "clipboardy": "^5.3.1",

40 "commander": "^15.0.0",

41 "diff": "^9.0.0",

42 "fast-glob": "^3.3.2",

43 "open": "^11.0.0",

44 "ora": "^9.4.0",

45 "simple-git": "^3.22.0",

46 "zod": "^4.4.3"

47 },

48 "devDependencies": {

49 "@biomejs/biome": "^2.5.0",

50 "@types/diff": "^7.0.2",

dist/index.jsView file

Lines 1-29javascript

1// @nalvietnam/avatar-cli — built with tsup

2var pc=Object.defineProperty;var R=(t,e)=>()=>(t&&(e=t(t=0)),e);var

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nalvietnam/avatar-cli@3.15.4 matchedIdentity = npm:QG5hbHZpZXRuYW0vYXZhdGFyLWNsaQ:3.15.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Findings

1 Critical4 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @nalvietnam/avatar-cli@3.17.3.

See all versions of @nalvietnam/avatar-cli for other recorded verdicts.

Review the evidence and your use of @nalvietnam/avatar-cli@3.17.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-17 01:58:04.611Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.