@nalvietnam/avatar-cli@3.34.4
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe bundle contains a real credential-forwarding capability to an unrestricted operator-configured endpoint, activated by the explicit doctor command and skipped with --no-probe. This warrants a warning for conditional credential exposure, not a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the doctor command with its default probe enabled and has an identity token available.
Impact
A URL configured to an unrelated host can receive the identity token.
Mechanism
Embedded Python reads the token through the package token reader and sends it as a bearer credential to AVATAR_TELEMETRY_URL or the default telemetry host. The configured URL is not restricted by a destination allowlist.
AI rationale
The bundle contains a real credential-forwarding capability to an unrestricted operator-configured endpoint, activated by the explicit doctor command and skipped with --no-probe. This warrants a warning for conditional credential exposure, not a publish block.
Evidence
dist/index.js
Network endpoints2
telemetry.nal.vn/api/telemetryAVATAR_TELEMETRY_URL
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The doctor probe reads an existing identity token and chooses its recipient from an environment variable, with a package telemetry host as the default.
- The probe sends that token as a bearer credential to the chosen URL; its URL selection has no destination allowlist.
- The doctor command runs the probe by default; users can skip it with an explicit no-probe option.
- The package install hook runs a welcome screen, while the flagged credential probe is tied to the doctor command.
Evidence against
- The doctor probe is user-invoked and has a no-probe option.
- The postinstall entry imports only the welcome-screen module and silently ignores its failures. The install hook does not invoke the probe.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
1// @nalvietnam/avatar-cli — built with tsup
L2: var U$=Object.defineProperty;var m=(e,t)=>()=>(e&&(t=e(e=0)),t);var Oe=(e,t)=>{for(var n in t)U$(e,n,{get:t[n],enumerable:!0})};function F(e){let t={schema_version:1,...e};t.schema...
L3: `)}function Ln(e,t){process.stderr.write(`${JSON.stringify({schema_version:1,command:e,error:t})}
...
L10: `),plain:e=>zo(`${e}
L11: `)}});var Fn={};Oe(Fn,{atomicSwapDir:()=>Xo,computeFileSha256:()=>Qo,copyDirRecursive:()=>Yo,downloadFile:()=>Jd,ensureDir:()=>R,extractTarballToDir:()=>zd,pathExists:()=>g,readJso...
L12: `,n)}async function Yo(e,t,n=[]){await R(t);let r=await pe.readdir(e,{withFileTypes:!0});for(let o of r){if(n.includes(o.name))continue;let i=Vs(e,o.name),s=Vs(t,o.name);if(o.isDir...
L13: `).filter(c=>c.trim().length>0)):r(new Error(`tar
Findings
3 Critical6 High4 Medium6 Low
CriticalCommand Output Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.34.4.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Review the evidence and your use of @nalvietnam/avatar-cli@3.34.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.