registry / @scarn/cli / 0.8.3
@scarn/cli@0.8.3
Scarn runs AI agents over your backlog, on your machines. This CLI links your repo, designs pipelines with an agent, and runs the workers that execute them.
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe postinstall hook only recovers the matching optional platform binary from the configured npm registry when it is missing. The flagged GitHub token flow is used for GitHub repository or tarball retrieval by the bundled devcontainer CLI, and no unrelated credential exfiltration or other attack behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Postinstall checks for a missing optional platform dependency; the bundled CLI runs when the user invokes scarn.
Impact
No unrelated credential transfer or other malicious behavior was identified.
Mechanism
The recovery path fetches the matching platform package from the configured npm registry and writes its binary under dist/. The bundled devcontainer CLI sends GITHUB_TOKEN as authorization for GitHub repository or tarball requests.
AI rationale
The postinstall hook only recovers the matching optional platform binary from the configured npm registry when it is missing. The flagged GitHub token flow is used for GitHub repository or tarball retrieval by the bundled devcontainer CLI, and no unrelated credential exfiltration or other attack behavior was identified.
Evidence
dist/<platform-binary>dist/<platform-binary>.download-<pid>
Network endpoints4
registry.npmjs.orgcontainers.devgithub.comapi.github.com
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package’s executable is bin/scarn; its automatic postinstall is limited to checking for a missing platform binary and recovering it when needed.
- Recovery fetches version metadata for the matching @scarn platform package from the configured npm registry, defaulting to registry.npmjs.org.
- The bundled devcontainer CLI uses GITHUB_TOKEN as Bearer authorization for GitHub repository or tarball operations; this is a service-appropriate use when the user runs a command that needs that feature.
- The wrapper passes command arguments to the compiled CLI binary, so the bundled devcontainer functionality runs through the CLI rather than as an independent install-time task.
Evidence against
- The package has an install-time postinstall script that can make network requests and write a binary.
- The bundled CLI reads GITHUB_TOKEN and includes network code; these accesses are tied to GitHub feature retrieval.
- The bundle also contacts containers.dev for its devcontainer control manifest.
Behavioral surface
ChildProcessCrypto
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.postinstall = node bin/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node bin/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/devcontainer/dist/spec-node/devcontainers-cli.jsView file
6var hL=Object.create;var LI=Object.defineProperty;var fL=Object.getOwnPropertyDescriptor;var dL=Object.getOwnPropertyNames;var pL=Object.getPrototypeOf,DL=Object.prototype.hasOwnPr...
L7: `)};function sw(A){var e=/\.[^.]*$/.exec(A);return e?e.index+1:A.length}function gw(A,e,t){if(A.reduce)return A.reduce(e,t);for(var i=0,r=arguments.length>=3?t:A[i++];i<A.length;i+...
L8:
L9: `),x())}function x(k){if(k||l--,u++,c===u&&l===0&&r!==void 0)return r(B||null)}}});var by=O((kz,Ny)=>{"use strict";Ny.exports=function A(e){var t=arguments.length;if(typeof e=="fun...
L10: `).join(`
...
L12: `)}function x1(A){A?process.env.DEBUG=A:delete process.env.DEBUG}function J1(){return process.env.DEBUG}function K1(A){A.inspectOpts={};let e=Object.keys(it.inspectOpts);for(let t=...
L13: `).map(e=>e.trim()
Findings
1 Critical8 High5 Medium5 Low
CriticalCredential Exfiltrationdist/devcontainer/dist/spec-node/devcontainers-cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/devcontainer/dist/spec-node/devcontainers-cli.js
HighSame File Env Network Executiondist/devcontainer/dist/spec-node/devcontainers-cli.js
HighCommand Output Exfiltrationdist/devcontainer/dist/spec-node/devcontainers-cli.js
HighSemantic Analysis Limitedbin/postinstall.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/devcontainer/dist/spec-node/devcontainers-cli.js
HighKnown Malware Source Similaritybin/postinstall.js
HighKnown Malware Source Fingerprint Signaturedist/devcontainer/dist/spec-node/devcontainers-cli.js
Affected versions and remediation
This report applies to @scarn/cli@0.8.3.
See all versions of @scarn/cli for other recorded verdicts.
- Review the evidence and your use of @scarn/cli@0.8.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.