registry / @nalvietnam/avatar-cli / 3.27.0
@nalvietnam/avatar-cli@3.27.0
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe static malicious verdict is not supported: postinstall only displays a welcome screen. The explicit-init remote pack and MCP setup remain a first-party agent-extension lifecycle risk that warrants a warning.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Explicit `avatar init` / GitNexus setup
Impact
Downloaded pack content can extend Claude Code capabilities in the initialized workspace.
Mechanism
remote team-pack mounting and MCP registration
AI rationale
The static malicious verdict is not supported: postinstall only displays a welcome screen. The explicit-init remote pack and MCP setup remain a first-party agent-extension lifecycle risk that warrants a warning.
Evidence
package.jsonbin/postinstall.jsbin/avatar.jsdist/index.jsdist/index.js.map.claude/pack/.claude/skills/.claude/agents/.claude/commands/.claude/hooks/.claude/workflows/.claude/scripts/.claude/knowledge/~/.claude/mcp_servers.json
Network endpoints1
qpdbkewtpkkbcrptnlos.supabase.co/functions/v1/get-pack
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit `avatar init` fetches a team pack and mounts Claude skills, agents, commands, hooks, workflows, and scripts.
- Init automatically enables every tool discovered in the downloaded pack.
- The GitNexus setup writes a user-level Claude MCP server entry.
Evidence against
- The sole postinstall imports a welcome-screen printer and exits silently; it does not start CLI setup.
- No install hook downloads a payload, changes Claude configuration, or runs shell commands.
- Network use is tied to named NAL auth/pack services and user-invoked CLI features.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @nalvietnam/avatar-cli@3.25.2
matchedIdentity = npm:QG5hbHZpZXRuYW0vYXZhdGFyLWNsaQ:3.25.2
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
1 Critical5 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.27.0.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Review the evidence and your use of @nalvietnam/avatar-cli@3.27.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.