registry / @pentoshi/clai / 2.0.31

@pentoshi/clai@2.0.31

⚠ Under review

A fast, cross-platform AI CLI assistant with ask and agent modes for shell tasks, file operations, and cybersecurity workflows.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 130 file(s), 1.14 MB of source, external domains: agentrouter.org, api.anthropic.com, api.github.com, api.groq.com, api.openai.com, bedrock-mantle.ap-south-1.api.aws, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, integrate.api.nvidia.com, llm.kimchi.dev, openrouter.ai, router.bynara.id

Source & flagged code

3 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or hostname literal) as

3 * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth

4 * for address classification: `web.fetch` (classifier branch + per-hop

5 * resolution check), `src/safety/classifier.ts`, and the legacy

6 * `http.fetch` check (via {@link isBlockedAddress}) all delegate here.

7 */

8import net from "node:net";

dist/agent/tool-call-parser.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pentoshi/clai@2.0.27 matchedIdentity = npm:QHBlbnRvc2hpL2NsYWk:2.0.27 similarity = 0.829 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent/tool-call-parser.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/store/keys.jsView file

34try { L35: const imported = (await import(keychainModuleName)); L36: cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

dist/tools/web/ssrf-guard.jsView file

2* SSRF guard — classifies an address (or hostname literal) as L3: * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth L4: * for address classification: `web.fetch` (classifier branch + per-hop ... L7: */ L8: import net from "node:net"; L9: /**

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web/ssrf-guard.jsView on unpkg · L2

dist/agent/tool-call-parser.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent/tool-call-parser.jsView on unpkg

Findings

1 Critical1 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/agent/tool-call-parser.js

HighCloud Metadata Accessdist/tools/web/ssrf-guard.js

MediumDynamic Requiredist/store/keys.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or hostname literal) as

3 * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth

4 * for address classification: `web.fetch` (classifier branch + per-hop

5 * resolution check), `src/safety/classifier.ts`, and the legacy

6 * `http.fetch` check (via {@link isBlockedAddress}) all delegate here.

7 */

8import net from "node:net";

dist/agent/tool-call-parser.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/agent/tool-call-parser.jsView on unpkg