registry / Remote code execution / @provenly/cli
@provenly/cli
Provenly CLI - Developer intelligence at your fingertips
This report shows the evidence for @provenly/cli@1.0.0. 1 of 2 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package performs automatic execution of a mutable remote binary at install time, with optional same-origin checksum validation. That is a concrete install-time remote payload execution surface.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
A release/asset compromise can execute arbitrary code as the installing user.
Mechanism
remote binary download and install-time execution
Attack narrative
During postinstall, install.js requests the latest release metadata, follows asset URLs supplied by that response, saves the selected platform binary under bin/, marks it executable, then runs it with `version`. Checksum verification is optional and its checksum is fetched from the same mutable release source. This creates an unconsented install-time remote-code-execution path if the release or delivery path is compromised.
AI rationale
The package performs automatic execution of a mutable remote binary at install time, with optional same-origin checksum validation. That is a concrete install-time remote payload execution surface.
Evidence
package.jsoninstall.jsbin/prov.jsbin/provbin/prov.exe
Network endpoints1
api.github.com/repos/devup-io/provenly-releases/releases/latest
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node install.js` in postinstall.
- install.js fetches the latest GitHub release, not a pinned artifact.
- install.js writes the downloaded executable to bin/prov and chmods it.
- install.js executes that downloaded binary during postinstall.
- Checksum verification is skipped when checksums.txt is absent or unavailable.
Evidence against
- No credential harvesting or unrelated file access appears in the JavaScript wrapper.
- bin/prov.js only forwards explicit CLI arguments to the installed binary.
Behavioral surface
ChildProcessCryptoFilesystemNetwork
UrlStrings
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgFindings
1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @provenly/cli@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @provenly/cli@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.