registry / @override-dev/cli / 0.1.0-alpha.10

@override-dev/cli@0.1.0-alpha.10

Override — the dev control plane: environments, repos, services, tasks

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install for postinstall chmod; explicit `ovr bootstrap` for shell/Claude setup; explicit ovr commands for git/setup/service actions

Impact

Potential user-approved shell or Claude Code config changes; no unconsented broad AI-agent control mutation found

Mechanism

install helper chmod and user-invoked dev environment orchestration

Rationale

Static source inspection does not support the scanner's malicious persistence/backdoor label; risky primitives are tied to declared CLI workflows or a narrow dependency chmod. Because the package includes explicit user-command Claude Code setup, downgrade to warn rather than block.

Evidence

package.jsonscripts/postinstall.mjsdist/cli/index.jsdist/index-85xjm9cd.jsdist/plugins/supabase.jsnode_modules/node-pty/prebuilds/<platform>/spawn-helpernode_modules/.pnpm/node-pty@*/node_modules/node-pty/prebuilds/<platform>/spawn-helper~/.zshrc~/.bashrc~/.claude/settings.json~/.config/ovr/ports.json~/.config/ovr/keys.json.ovr/answers.json.ovr/setup

Network endpoints2

localhost:3000127.0.0.1:${apiPort}

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines install-time postinstall script
scripts/postinstall.mjs chmods node-pty prebuild spawn-helper files under node_modules
dist/cli/index.js bootstrap can hand off a Claude prompt to edit shell prompt or ~/.claude/settings.json after interactive confirmation
dist/cli/index.js imports user ovr.config.* files and can run configured setup commands during explicit CLI workflows

Evidence against

postinstall is limited to chmod 0755 on node-pty spawn-helper; no network, shell, credential read, or agent config writes
Claude/shell integration is only in ovr bootstrap, interactive/user-confirmed, not install-time or import-time
Network use is package-aligned: git clone/fetch/pull, optional team config URL import, localhost readiness/Supabase
child_process use supports declared dev-control-plane workflows and user-configured service execution
No evidence of credential harvesting or exfiltration endpoints

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 13 file(s), 279 KB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

package.jsonView file

Lines 11-51json

11 "scripts/postinstall.mjs"

12 ],

13 "exports": {

14 ".": {

15 "types": "./dist/core/core.d.ts",

16 "default": "./dist/core/core.js"

17 },

18 "./plugin/shell": {

19 "types": "./dist/plugins/shell.d.ts",

20 "default": "./dist/plugins/shell.js"

21 },

22 "./plugin/supabase": {

23 "types": "./dist/plugins/supabase.d.ts",

24 "default": "./dist/plugins/supabase.js"

25 },

26 "./package.json": "./package.json"

27 },

28 "scripts": {

29 "build": "bun build src/cli/index.ts src/core/core.ts src/plugins/shell.ts src/plugins/supabase.ts --root src --outdir=dist --target=node --splitting --format=esm --packages=external && tsc -p tsconfig.build.json && node scripts/fix-dts.mjs && bun build packages/plugin-portless/src/index.ts --outdir=packages/plugin-portless/dist --target=node --format=esm --packages=external && tsc -p packages/plugin-portless/tsconfig.build.json && node scripts/fix-dts.mjs packages/plugin-portless/dist && bun build packages/plugin-docker/src/index.ts --outdir=packages/plugin-docker/dist --target=node --for ...

30 "dev": "bun build src/cli/index.ts src/core/core.ts src/plugins/shell.ts src/plugins/supabase.ts --root src --outdir=dist --target=node --splitting --format=esm --packages=external --watch",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepare": "bun run build",

33 "test": "bun run build && bun test"

34 },

35 "engines": {

36 "node": ">=22.6"

37 },

38 "dependencies": {

39 "@clack/prompts": "^1.6.0",

40 "@xterm/headless": "^6.0.0",

41 "ink": "^7.1.0",

42 "node-pty": "^1.1.0",

43 "react": "^19.2.7"

44 },

45 "devDependencies": {

46 "@types/node": "^22.10.0",

47 "@types/react": "^19.2.17",

48 "typescript": "^5.7.2"

49 }

50}

Long lines were clipped for display.

dist/cli/index.jsView file

Lines 18-58javascript

18 activeName,

19 forkChain,

20 getWorkspace,

21 inferContext,

22 loadConfig,

23 mergeTeam,

24 normalizeRemote,

25 parseTeam,

26 repoBranch,

27 repoUrl,

28 resolveBranch,

29 resolveEnvSlug,

30 resolveInfisical,

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

38import * as clack2 from "@clack/prompts"; L39: import { execFileSync as execFileSync3 } from "node:child_process"; L40: import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs"; ... L44: // src/util/color.ts L45: var useColor = process.stdout.isTTY && !process.env.NO_COLOR; L46: var paint = (code, s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s; ... L56: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L57: import { createServer } from "node:net"; L58: import { dirname, join } from "node:path"; ... L63: try { L64: return JSON.parse(readFileSync(file, "utf8")); L65: } catch {

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cli/index.jsView on unpkg · L38

38Trigger-reachable chain: manifest.bin -> dist/cli/index.js L38: import * as clack2 from "@clack/prompts"; L39: import { execFileSync as execFileSync3 } from "node:child_process"; L40: import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs"; ... L44: // src/util/color.ts L45: var useColor = process.stdout.isTTY && !process.env.NO_COLOR; L46: var paint = (code, s) => useColor ? `\x1B[${code}m${s}\x1B[0m` : s; ... L56: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; L57: import { createServer } from "node:net"; L58: import { dirname, join } from "node:path"; ... L63: try { L64: return JSON.parse(readFileSync(file, "utf8")); L65: } catch {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L38

•matchType = previous_version_dangerous_delta matchedPackage = @override-dev/cli@0.1.0-alpha.7 matchedIdentity = npm:QG92ZXJyaWRlLWRldi9jbGk:0.1.0-alpha.7 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

397return null; L398: const mod = await import(pathToFileURL(file).href); L399: const config = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView on unpkg · L397

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L38

Findings

3 Critical1 High5 Medium7 Low

CriticalPersistence Backdoordist/cli/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js

CriticalPrevious Version Dangerous Deltadist/cli/index.js

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

package.jsonView file

Lines 11-51json

11 "scripts/postinstall.mjs"

12 ],

13 "exports": {

14 ".": {

15 "types": "./dist/core/core.d.ts",

16 "default": "./dist/core/core.js"

17 },

18 "./plugin/shell": {

19 "types": "./dist/plugins/shell.d.ts",

20 "default": "./dist/plugins/shell.js"

21 },

22 "./plugin/supabase": {

23 "types": "./dist/plugins/supabase.d.ts",

24 "default": "./dist/plugins/supabase.js"

25 },

26 "./package.json": "./package.json"

27 },

28 "scripts": {

30 "dev": "bun build src/cli/index.ts src/core/core.ts src/plugins/shell.ts src/plugins/supabase.ts --root src --outdir=dist --target=node --splitting --format=esm --packages=external --watch",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "prepare": "bun run build",

33 "test": "bun run build && bun test"

34 },

35 "engines": {

36 "node": ">=22.6"

37 },

38 "dependencies": {

39 "@clack/prompts": "^1.6.0",

40 "@xterm/headless": "^6.0.0",

41 "ink": "^7.1.0",

42 "node-pty": "^1.1.0",

43 "react": "^19.2.7"

44 },

45 "devDependencies": {

46 "@types/node": "^22.10.0",

47 "@types/react": "^19.2.17",

48 "typescript": "^5.7.2"

49 }

50}

Long lines were clipped for display.

dist/cli/index.jsView file

Lines 18-58javascript

18 activeName,

19 forkChain,

20 getWorkspace,

21 inferContext,

22 loadConfig,

23 mergeTeam,

24 normalizeRemote,

25 parseTeam,

26 repoBranch,

27 repoUrl,

28 resolveBranch,

29 resolveEnvSlug,

30 resolveInfisical,