registry / @provenly/cli / 0.100.0

@provenly/cli@0.100.0

Provenly CLI - Developer intelligence at your fingertips

AI Security Review

scanned 2d ago · by lpm-firewall-ai

On npm installation, the package downloads a platform-native executable selected from the latest repository release. It writes and executes that uninspected binary during postinstall.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

A later or compromised release can execute arbitrary code with the installing user's privileges.

Mechanism

remote native-binary download, installation, and execution

Rationale

No source evidence establishes malicious intent or credential theft, but this is a concrete install-time remote payload execution chain with insufficient payload pinning. Treat it as a staged payload carrier and warn.

Evidence

package.jsoninstall.jsbin/prov.jsREADME.mdbin/prov

Network endpoints1

api.github.com/repos/devup-io/prov/releases/latest

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

package.json runs `node install.js` at postinstall.

@provenly/cli@0.100.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code