registry  /  @rstreamlabs/rstream-cli  /  1.24.2

@rstreamlabs/rstream-cli@1.24.2

Command-line interface for rstream.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installation invokes a dependency-provided installer configured to obtain a hosted native binary. The inspected wrapper then runs `release/bin/rstream` on explicit CLI use; no malicious source behavior is confirmed.

Static reason
One or more suspicious static signals were detected.
Trigger
`npm install` downloads/stages the binary; running `rstream` executes it.
Impact
Remote binary content is outside the inspected package source and can determine runtime behavior.
Mechanism
install-time hosted native-binary staging followed by local binary execution
Rationale
No concrete credential theft, exfiltration, persistence, destructive behavior, or stealth execution is present in the inspected source. The install-time remote binary retrieval remains a material, uninspectable supply-chain risk.
Evidence
package.jsonREADME.mddist/main.jsrelease/bin/rstream
Network endpoints1
rstream.io

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` defines an npm `install` hook: `rstream-installer`.
  • `package.json` configures installer registry `https://rstream.io`.
  • `README.md` states install downloads an OS/architecture binary into `release/`.
  • `dist/main.js` executes that locally installed binary with `spawn`.
  • The installer implementation and downloaded binary are absent from this package.
Evidence against
  • `dist/main.js` is a small transparent CLI wrapper.
  • No source reads environment variables, credentials, or user files.
  • No exfiltration, shell evaluation, persistence, or destructive operation appears in inspected files.
  • CLI arguments are forwarded to the local binary with inherited stdio.
Behavioral surface
Source
ChildProcessFilesystemShell
Supply chainNo supply-chain packaging signals triggered.
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 820 B of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.install = rstream-installer
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.install = rstream-installer
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem