Loading npm security reports…

@solidnumber/cli@2.24.2: Suspicious npm security report (Warn) | LPM Firewall

registry / @solidnumber/cli / 2.24.2

@solidnumber/cli@2.24.2

Be There — the system that answers, books, and takes payment when you can't. CLI + SDK + MCP tools for SMBs, agencies, and AI agents. solid clone plumber → working business in 30 seconds.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This CLI is first-party Solid# tooling. npm postinstall only prints a banner. Running solid setup or solid install writes Solid MCP server entries and a Claude Code SessionStart hook into editor config files, and first CLI use pings the Solid identity API.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user runs solid setup, solid install, solid mcp, or solid context with editor flags after install; first solid invocation also runs silent identity telemetry.

Impact

Claude Code, Cursor, Windsurf, or VS Code can load Solid MCP access and auto-refresh .claude/CLAUDE.md; an anonymous machine id is stored and posted to Solid.

Mechanism

user-invoked first-party editor MCP and Claude hook setup

AI rationale

Inspected source shows a first-party Solid# CLI: postinstall is a banner only, while solid setup and solid install write MCP keys and Claude Code session hooks. That is user-invoked first-party agent extension setup, so the package is warned rather than blocked.

Evidence

dist/commands/setup.jsdist/commands/install.jsdist/commands/context.jsdist/lib/mcp-client-config.jsdist/lib/mcp-sync.jsdist/lib/first-run.jspackage.json~/.claude/settings.json~/.claude.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json~/.solid/identity.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

solid setup is first-party onboarding that wires editor MCP and a Claude SessionStart hook, with --yes auto-accepting the editor prompt.
solid install writes a SessionStart hook into ~/.claude/settings.json so later Claude Code sessions run solid context --claude.
solid context --claude writes .claude/CLAUDE.md and .claude/solid-context.json into the working tree.
MCP install merges a Solid server entry and API key into editor configs such as ~/.claude.json and ~/.cursor/mcp.json.
The first solid CLI run silently writes ~/.solid/identity.json and POSTs a machine id to the Solid identity API.
npm postinstall only prints a get-started banner and does not write agent configs or open a network connection.

Evidence against

No runtime self-dependency on another @solidnumber/cli release, and no eval or obfuscated downloader in inspected dist files.
Scanner malware-similarity hits are ordinary product modules (open, demo, serve, audit, bids, chains) plus an offline mutation queue.
Agent-config writes run only after the user invokes solid setup, solid install, solid mcp, or solid context with editor flags, not from postinstall.
Several dist files failed AST parse, so this is a warn on a confirmed user-invoked agent surface rather than a clean bill of health.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 186 file(s), 2.55 MB of source, external domains: agent-plugins.org, api.solidnumber.com, app.solidnumber.com, claude.ai, code.visualstudio.com, cursor.com, developers.solidnumber.com, ex.com, example.com, github.com, grok.com, me.ngrok.app, pay.solidnumber.com, placehold.co, registry.npmjs.org, schema.org, showerpros.com, solidnumber.com, stitch.withgoogle.com, www.figma.com, www.npmjs.com, www.w3.org, www.youtube.com, your-url.com

Source & flagged code

22 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{if(!process.env.CI)console.log('\n Solid# CLI installed. Get started: solid setup\n')}catch(e){}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{if(!process.env.CI)console.log('\n Solid# CLI installed. Get started: solid setup\n')}catch(e){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/lib/esm-import.jsView file

18*/ L19: const dynamicEsmImport = new Function('specifier', 'return import(specifier)'); L20: function importESM(specifier) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/esm-import.jsView on unpkg · L18

dist/commands/completion.jsView file

9Trigger-reachable persistence chain: scripts.start -> dist/index.js -> dist/commands/completion.js L9: * L10: * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced L11: * by your shell — see the generated header comment). ... L183: const path = require('path'); L184: const shell = (process.env.SHELL || '').toLowerCase(); L185: const home = os.homedir(); L186: if (shell.includes('fish')) { ... L237: .description('Generate or install shell completion (reflects the live command tree)') L238: .option('--bash', 'Generate bash completion to stdout') L239: .option('--fish', 'Generate fish completion to stdout')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/commands/completion.jsView on unpkg · L9

9* L10: * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced L11: * by your shell — see the generated header comment). ... L183: const path = require('path'); L184: const shell = (process.env.SHELL || '').toLowerCase(); L185: const home = os.homedir(); L186: if (shell.includes('fish')) { ... L237: .description('Generate or install shell completion (reflects the live command tree)') L238: .option('--bash', 'Generate bash completion to stdout') L239: .option('--fish', 'Generate fish completion to stdout')

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/completion.jsView on unpkg · L9

dist/lib/first-run.jsView file

56const telemetry_1 = require("./telemetry"); L57: const CONFIG_DIR = path.join(os.homedir(), '.solid'); L58: const IDENTITY_FILE = path.join(CONFIG_DIR, 'identity.json'); L59: function shouldSkip() { L60: if (process.env.SOLID_DISABLE_TELEMETRY === '1') L61: return true; L62: if (process.env.CI) L63: return true; ... L76: return null; L77: return JSON.parse(fs.readFileSync(IDENTITY_FILE, 'utf-8')); L78: } ... L99: function getApiBase() {

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/lib/first-run.jsView on unpkg · L56

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/lib/first-run.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/first-run.jsView on unpkg

dist/commands/visual.jsView file

21exports.visualCommand = void 0; L22: const child_process_1 = require("child_process"); L23: const chalk_1 = __importDefault(require("chalk")); ... L26: if (host) { L27: return host.startsWith('http') ? host : `https://${host}`; L28: } ... L30: // fall back to prod. Local dev users: SOLID_WEB_URL=http://localhost:3000 L31: const env = process.env.SOLID_WEB_URL || L32: (process.env.SOLID_API_URL ? process.env.SOLID_API_URL.replace('//api.', '//app.') : ''); ... L35: function openInBrowser(url) { L36: const platform = process.platform; L37: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start ""' : 'xdg-open';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/visual.jsView on unpkg · L21

dist/commands/install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: nkeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createbinding(result, mod, k[i]); __setmoduledefault(result, mod); return result; }; })(); var __importdefault = (this && this.__importdefault) || function (mod) { return (mod && mod.__esmodule) ? mod : { "default": mod }; }; object.defineproperty(exports, "__esmodule", { value: true }); exports.installcommand = void 0;

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/install.jsView on unpkg

dist/commands/context.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. jsonldpath = path.join(writeres.librarydir, '..', 'solid-context.jsonld'); fs.writefilesync(jsonldpath, jsonlddoc); jsonldbytes = buffer.bytelength(jsonlddoc, 'utf-8'); } spinner?.succeed(chalk_1.default.green('ai context library ready')); printladdernextsteps(writeres, jsonpath, jsondoc ? buffer.bytelength(jsondoc, 'utf-8') : 0, jsonldpath, jsonldbytes); return; } catch (error) { spinner?.fail(chalk_1.default.red('failed to build ddc library')); console.error(chalk_1.

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/commands/context.jsView on unpkg

dist/commands/apply.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/apply.js#virtual:normalized:round1View on unpkg

dist/commands/open.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/open.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/open.jsView on unpkg

dist/commands/demo.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/demo.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/demo.jsView on unpkg

dist/commands/serve.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/serve.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/serve.jsView on unpkg

dist/commands/audit.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/audit.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/audit.jsView on unpkg

dist/commands/feedback.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/feedback.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/feedback.jsView on unpkg

dist/commands/render.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/render.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/render.jsView on unpkg

dist/lib/offline-queue.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/lib/offline-queue.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/offline-queue.jsView on unpkg

dist/commands/bids.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/bids.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/bids.jsView on unpkg

dist/commands/chains.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/chains.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/chains.jsView on unpkg

dist/commands/docs.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/docs.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/docs.jsView on unpkg

dist/commands/explore.jsView file

•matchType = normalized_sha256 matchedPackage = @solidnumber/cli@2.20.0 matchedPath = dist/commands/explore.js matchedIdentity = npm:QHNvbGlkbnVtYmVyL2NsaQ:2.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/explore.jsView on unpkg