@nalvietnam/avatar-cli@3.41.0
AI harness CLI for NAL Vietnam engineering
AI Security Review
scanned 3d ago · by lpm-firewall-aiStatic source confirms that the diagnostic sends a saved ID token to a configurable endpoint outside its intended authentication service, so conditional credential exposure remains. Because the transfer is activated by an explicit diagnostic command and has an opt-out, this supports a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes `avatar doctor` without `--no-probe`.
Impact
The telemetry recipient receives the existing service token, creating conditional credential exposure outside its intended authentication service.
Mechanism
The diagnostic reads an ID token through `token_reader`, constructs an authenticated POST, and sends it to the default telemetry URL or the `AVATAR_TELEMETRY_URL` override.
AI rationale
Static source confirms that the diagnostic sends a saved ID token to a configurable endpoint outside its intended authentication service, so conditional credential exposure remains. Because the transfer is activated by an explicit diagnostic command and has an opt-out, this supports a warning rather than a publish block.
Evidence
dist/index.js
Network endpoints2
telemetry.nal.vn/api/telemetryAVATAR_TELEMETRY_URL
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The `avatar doctor` command runs the probe by default; `--no-probe` disables it.
- The probe reads an existing ID token and sends it as a bearer credential to a URL that defaults to the package telemetry service and can be overridden through an environment variable.
- The install hook only prints a welcome screen and is unrelated to the runtime token transfer.
Evidence against
- The transfer requires a user to invoke `avatar doctor`, and the CLI offers an explicit `--no-probe` opt-out.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
10`),plain:e=>da(`${e}
L11: `)}});var no={};Rt(no,{atomicSwapDir:()=>ua,computeFileSha256:()=>pa,copyDirRecursive:()=>la,downloadFile:()=>Pg,ensureDir:()=>S,extractTarballToDir:()=>Tg,pathExists:()=>k,readJso...
L12: `,n)}async function la(e,t,n=[]){await S(t);let r=await Ne.readdir(e,{withFileTypes:!0});for(let o of r){if(n.includes(o.name))continue;let i=Gd(e,o.name),s=Gd(t,o.name);if(o.isDir...
High
Child Process
Package source references child process execution.
Findings
7 High4 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @nalvietnam/avatar-cli@3.41.0.
See all versions of @nalvietnam/avatar-cli for other recorded verdicts.
- Review the evidence and your use of @nalvietnam/avatar-cli@3.41.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.