@nalvietnam/avatar-cli@3.37.1
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe bundle confirms an existing ID token is sent to the default telemetry recipient when the doctor probe runs. This is concrete credential disclosure, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the doctor command without disabling the probe.
Impact
The telemetry recipient receives an authentication credential without a separate consent step for that transfer.
Mechanism
The probe reads an ID token and includes it as a bearer credential in a POST request to the telemetry service.
Attack narrative
The doctor command enables the telemetry probe by default. The probe obtains an existing ID token and sends it as a bearer credential to the package-selected telemetry endpoint. The --no-probe option disables this transfer, but it is an opt-out rather than affirmative consent.
AI rationale
The bundle confirms an existing ID token is sent to the default telemetry recipient when the doctor probe runs. This is concrete credential disclosure, so the package should be blocked.
Evidence
dist/index.js
Network endpoints1
telemetry.nal.vn/api/telemetry
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The telemetry probe reads an existing ID token from the shared token reader.
- The probe defaults to the package-selected telemetry endpoint.
- The probe sends the ID token as a bearer credential in a POST request.
- Running the doctor command enables the probe by default; --no-probe disables it.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @nalvietnam/avatar-cli@3.36.1
matchedIdentity = npm:QG5hbHZpZXRuYW0vYXZhdGFyLWNsaQ:3.36.1
similarity = 0.750
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
Findings
1 Critical8 High4 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.37.1.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Avoid installing @nalvietnam/avatar-cli@3.37.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.