@nalvietnam/avatar-cli@3.19.9
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo concrete malicious install-time behavior or credential exfiltration was found. The explicit-command remote agent configuration path and optional integrity check warrant a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `avatar init` or `avatar sync`.
Impact
A server-controlled pack can introduce or activate workspace AI-agent tools and hooks.
Mechanism
authenticated remote pack download, extraction, and `.claude` settings/hook merge
AI rationale
No concrete malicious install-time behavior or credential exfiltration was found. The explicit-command remote agent configuration path and optional integrity check warrant a warning.
Evidence
package.jsonbin/postinstall.jsdist/index.jsREADME.mddist/lib/print-welcome-screen.js.claude/pack.claude/settings.json.claude/avatar-tools.json
Network endpoints1
qpdbkewtpkkbcrptnlos.supabase.co/functions/v1/get-pack
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.js: `init`/`sync` download and unpack a remote team pack into `.claude/pack`.
- dist/index.js: missing SHA-256 only emits a warning and still installs the fetched tarball.
- dist/index.js: sync merges pack settings and auto-enables newly supplied tools, including hooks.
Evidence against
- bin/postinstall.js only imports and prints a welcome screen; it does not mutate projects or access the network.
- Remote pack fetch is authenticated and only reached through explicit CLI commands.
- dist/index.js restricts default Supabase endpoint hosts and validates HTTPS.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @nalvietnam/avatar-cli@3.15.4
matchedIdentity = npm:QG5hbHZpZXRuYW0vYXZhdGFyLWNsaQ:3.15.4
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
1 Critical6 High5 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighTrigger Reachable Persistencedist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.19.9.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Review the evidence and your use of @nalvietnam/avatar-cli@3.19.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.