registry  /  @star-setup/star-setup  /  0.4.6

@star-setup/star-setup@0.4.6

Lightweight CLI to clone, configure, and wire single or multi-repo ecosystems

AI Security Review

scanned 11h ago · by lpm-firewall-ai

The npm lifecycle fetches and extracts an opaque native binary from the package's GitHub release. Source inspection shows a package-aligned binary installer, but the downloaded executable is not inspectable from the package source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall; later star-setup CLI invocation
Impact
Installs a native executable for later user-invoked CLI use; no confirmed malicious behavior in package JS
Mechanism
install-time platform binary download and extraction
Attack narrative
On install, install.js selects the host platform in binary.js, builds a URL under the package's GitHub v0.4.6 release, downloads the archive with axios, and extracts it into node_modules/.bin_real. The bin wrapper later spawns that installed executable with user CLI arguments. No source evidence shows exfiltration, persistence, destructive behavior, or AI-agent control-surface mutation.
Rationale
This is not malicious by inspected source facts, but install-time retrieval of an opaque native executable leaves unresolved staged-payload risk that merits a warning rather than a block. The behavior is package-aligned and scoped to its own binary install directory.
Evidence
package.jsoninstall.jsbinary.jsbinary-install.jsrun-star-setup.jsREADME.mdnode_modules/.bin_real
Network endpoints1
github.com/star-setup/core/releases/download/v0.4.6

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node ./install.js
  • install.js calls binary.install(false) during npm lifecycle
  • binary-install.js downloads a platform release asset and extracts it into node_modules/.bin_real
  • run-star-setup.js executes the installed native star-setup binary on CLI invocation
Evidence against
  • Download URL is package-aligned GitHub release v0.4.6, not an unrelated host
  • Install code does not execute the downloaded binary during postinstall
  • No credential/env harvesting or exfiltration logic found in JS sources
  • No writes to AI-agent control surfaces, shell startup files, VCS hooks, or autostart entries found
  • Filesystem changes are scoped to this package's node_modules/.bin_real install directory
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
Manifest
NoLicense
scanned 4 file(s), 10.0 KB of source, external domains: example.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License