@nalvietnam/avatar-cli@3.29.0
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe doctor probe forwards an existing token to an operator-configurable endpoint without a visible destination restriction, creating conditional credential exposure. Because the probe is user-invoked and can be disabled, this warrants a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the doctor command; the probe runs unless `--no-probe` is supplied.
Impact
If a user or environment sets the endpoint to an unrelated host, the token is exposed to that host.
Mechanism
The probe reads a token, selects `AVATAR_TELEMETRY_URL` or the vendor default, and sends a POST with the token in the Authorization bearer header.
AI rationale
The doctor probe forwards an existing token to an operator-configurable endpoint without a visible destination restriction, creating conditional credential exposure. Because the probe is user-invoked and can be disabled, this warrants a warning rather than a publish block.
Evidence
dist/index.js
Network endpoints1
telemetry.nal.vn/api/telemetry
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The doctor command runs the telemetry probe by default; users can disable it with `--no-probe`.
- The probe reads an existing token and accepts `AVATAR_TELEMETRY_URL` as its destination without an evident host restriction.
- The probe sends that token in a bearer-authenticated POST, even though the body contains only a probe marker.
- The bundle comments claim the response can confirm token validity; this is source text, not proof that the endpoint is safe.
- The manifest's postinstall hook imports a welcome-screen module, while that module's body was not independently inspected.
- The bundle's agent configuration marker identifies a Claude workspace config path; this excerpt alone shows no write or mutation.
Evidence against
- The probe is part of the explicit doctor command and offers a `--no-probe` opt-out; no install-time probe was established.
- The configured default telemetry host belongs to the package's vendor domain.
- The cited agent configuration code only checks whether the Claude config path exists.
Behavioral surface
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
1// @nalvietnam/avatar-cli — built with tsup
L2: var Dm=Object.defineProperty;var O=(t,e)=>()=>(t&&(e=t(t=0)),e);var wt=(t,e)=>{for(var n in e)Dm(t,n,{get:e[n],enumerable:!0})};function Pt(t){let e={schema_version:1,...t};e.schem...
L3: `)}function fe(t,e){process.stderr.write(`${JSON.stringify({schema_version:1,command:t,error:e})}
...
L10: `),plain:t=>ze(`${t}
L11: `)}});var we={};wt(we,{atomicSwapDir:()=>Xe,computeFileSha256:()=>vo,copyDirRecursive:()=>wo,downloadFile:()=>yo,ensureDir:()=>S,extractTarballToDir:()=>bo,pathExists:()=>g,readJso...
L12: `,n)}async function wo(t,e,n=[]){await S(e);let r=await q.readdir(t,{withFileTypes:!0});for(let o of r){if(n.includes(o.name))continue;let i=Un(t,o.name),s=Un(e,o.name);if(o.isDire...
L13: `).filter(c=>c.trim().length>0)):r(new Error(`tar
Findings
3 Critical6 High4 Medium6 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShell
HighSame File Env Network Executiondist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.29.0.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Review the evidence and your use of @nalvietnam/avatar-cli@3.29.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.