registry  /  @rstreamlabs/rstream-cli  /  1.24.0

@rstreamlabs/rstream-cli@1.24.0

Command-line interface for rstream.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface in the inspected package source. Install invokes a package-aligned installer dependency; runtime forwards explicit CLI arguments to the installed rstream binary.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs `rstream-installer`; invoking `rstream` runs `dist/main.js`.
Impact
No concrete malicious behavior is established from package-owned source.
Mechanism
Package-aligned binary installation and CLI process forwarding.
Rationale
The static hint is explained by a binary-installer lifecycle hook and `child_process.spawn`, both consistent with this package's stated CLI purpose. The inspected package code contains no concrete malicious chain.
Evidence
package.jsondist/main.js
Network endpoints1
rstream.io

Decision evidence

public snapshot
AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for block
  • `package.json` defines an `install` lifecycle command: `rstream-installer`.
  • `package.json` configures the installer registry as `https://rstream.io`.
Evidence against
  • `dist/main.js` is a thin CLI wrapper with no network, eval, dynamic loading, or harvesting logic.
  • The runtime only checks for `release/bin/rstream` and spawns it with user-supplied CLI arguments.
  • No package files implement credential collection, exfiltration, persistence, destructive actions, or AI-agent configuration changes.
  • The lifecycle installer naming and registry configuration are aligned with installing the package's advertised `rstream` binary.
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 820 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.install = rstream-installer
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.install = rstream-installer
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem