Loading npm security reports…

@pentoshi/clai@3.8.8: Suspicious npm security report (Warn) | LPM Firewall

registry / @pentoshi/clai / 3.8.8

@pentoshi/clai@3.8.8

A fast, cross-platform AI CLI assistant with ask and agent modes for shell tasks, file operations, and cybersecurity workflows.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 285 file(s), 2.23 MB of source, external domains: agentrouter.org, api.anthropic.com, api.github.com, api.groq.com, api.openai.com, bedrock-mantle.ap-south-1.api.aws, bun.sh, dashscope-intl.aliyuncs.com, dns.google, generativelanguage.googleapis.com, github.com, home.qwencloud.com, html.duckduckgo.com, integrate.api.nvidia.com, llm.kimchi.dev, openrouter.ai, rdap.org, router.bynara.id

Source & flagged code

4 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tui/runtime.jsView file

Lines 1-24javascript

1/**

2 * OpenTUI requires Bun's native FFI. Node/tsx cannot initialize the renderer.

3 * Prefer re-exec under Bun when available; otherwise fall back with a clear hint.

4 */

5import { spawnSync } from "node:child_process";

6import { accessSync, constants } from "node:fs";

7import { delimiter, join }

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or hostname literal) as

3 * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth

4 * for address classification: `web.fetch` (classifier branch + per-hop

5 * resolution check), `src/safety/classifier.ts`, and the legacy

6 * `http.fetch` check (via {@link isBlockedAddress}) all delegate here.

7 */

8import net

dist/tools/shell.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pentoshi/clai@3.7.8 matchedIdentity = npm:QHBlbnRvc2hpL2NsYWk:3.7.8 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/shell.jsView on unpkg

Source & flagged code

4 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tui/runtime.jsView file

Lines 1-24javascript

1/**

2 * OpenTUI requires Bun's native FFI. Node/tsx cannot initialize the renderer.

3 * Prefer re-exec under Bun when available; otherwise fall back with a clear hint.

4 */

5import { spawnSync } from "node:child_process";

6import { accessSync, constants } from "node:fs";

7import { delimiter, join }

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or hostname literal) as

3 * private/loopback/link-local/cloud-metadata/CGNAT. Single source of truth

4 * for address classification: `web.fetch` (classifier branch + per-hop

5 * resolution check), `src/safety/classifier.ts`, and the legacy

6 * `http.fetch` check (via {@link isBlockedAddress}) all delegate here.

7 */

8import net

dist/tools/shell.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/tools/shell.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code