registry / Credential exfiltration / @nalvietnam/avatar-cli / 3.31.0

@nalvietnam/avatar-cli@3.31.0

AI harness CLI for NAL Vietnam engineering

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The diagnostic probe forwards an existing identity token to an endpoint that can be overridden without a visible destination restriction, creating a conditional credential exposure risk. Since the probe is explicitly activated and is not part of the install hook, the evidence supports a warning rather than a publish block.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A caller enables the diagnostic probe; the CLI provides a --no-probe option to skip it.

Impact

If the URL is set to an untrusted host, the token could be exposed to that host.

Mechanism

The probe reads an identity token and places it in the Authorization bearer header of an HTTPS POST to the configured telemetry URL.

AI rationale

Evidence

dist/index.js

Network endpoints1

telemetry.nal.vn/api/telemetry

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

A diagnostic probe reads an existing identity token and sends it as a bearer credential to a URL configurable through AVATAR_TELEMETRY_URL, which has no visible destination restriction.
The probe is invoked only when its caller enables probing; the CLI identifies it as a telemetry probe POST and offers a --no-probe skip.
The package install hook only loads a welcome screen, with CI and skip-variable guards; it does not invoke the diagnostic probe.
The indicated configuration code checks for the package's own .claude/avatar.json marker.

Evidence against

No evidence showed the diagnostic token probe runs during package installation or ordinary CLI startup.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

Source & flagged code

8 flagged

package.jsonView file

Lines 20-60json

20 "src/templates",

21 "README.md"

22 ],

23 "engines": {

24 "node": ">=18.17.0"

25 },

26 "scripts": {

27 "build": "tsup && tsc -p tsconfig.core-dts.json",

28 "dev": "tsup --watch",

29 "test": "vitest run --passWithNoTests --exclude 'test/integration/**' --testTimeout=15000",

30 "test:watch": "vitest --exclude 'test/integration/**'",

31 "test:e2e": "npm run build && vitest run --passWithNoTests test/integration --testTimeout=60000",

32 "test:all": "npm run test && npm run test:e2e",

33 "lint": "biome check src test scripts",

34 "format": "biome format --write src test scripts",

35 "typecheck": "tsc --noEmit",

36 "check:release-docs": "node scripts/check-unreleased-version-notice-removed.mjs",

37 "hooks:install": "git config core.hooksPath githooks",

38 "prepare": "git config core.hooksPath githooks || true",

39 "prepublishOnly": "npm run check:release-docs && npm run lint && npm run typecheck && npm run build && npm run test:all",

40 "postinstall": "node ./bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "dependencies": {

43 "@inquirer/prompts": "^8.5.2",

44 "@napi-rs/keyring": "^1.1.0",

45 "boxen": "^8.0.0",

46 "chalk": "^5.3.0",

47 "cli-highlight": "^2.1.11",

48 "cli-table3": "^0.6.3",

49 "clipboardy": "^5.3.1",

50 "commander": "^15.0.0",

51 "diff": "^9.0.0",

52 "fast-glob": "^3.3.2",

53 "open": "^11.0.0",

54 "ora": "^9.4.0",

55 "simple-git": "^3.22.0",

56 "zod": "^4.4.3"

57 },

58 "devDependencies": {

59 "@biomejs/biome": "2.5.0",

60 "@types/diff": "^7.0.2",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/index.jsView file

Lines 1-23javascript

1// @nalvietnam/avatar-cli — built with tsup

2var hp=Object.defineProperty;var I=(t,e)=>()=>(t&&(e=t(t=0)),e);var

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Findings

3 Critical4 High4 Medium6 Low

CriticalCommand Output Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

CriticalPrevious Version Dangerous Deltadist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighSame File Env Network Executiondist/index.js

HighTrigger Reachable Command Output Exfiltrationdist/index.js

HighSemantic Analysis Limitedpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @nalvietnam/avatar-cli@3.31.0.

See all versions of @nalvietnam/avatar-cli for other recorded verdicts.

Review the evidence and your use of @nalvietnam/avatar-cli@3.31.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 02:10:13.174Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.