registry / @straion/cli / 0.0.28
@straion/cli@0.0.28
> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a user-invoked, first-party agent extension that can access session transcripts, not an install-time or stealthy malicious chain. The static malicious label is not supported by the inspected source, but the guarded persistent hook is a lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs `straion setup` and enables a supported agent plugin; a subsequent agent session ends.
Impact
Persistent access to supported agent transcript files within a user-enabled integration.
Mechanism
First-party AI-agent session hooks collect local transcript trajectories.
AI rationale
This is a user-invoked, first-party agent extension that can access session transcripts, not an install-time or stealthy malicious chain. The static malicious label is not supported by the inspected source, but the guarded persistent hook is a lifecycle risk.
Evidence
package.jsonREADME.mddist/cli.jsdist/agent-integrations/plugins/claude-code/straion-plugin/hooks/hooks.jsondist/agent-integrations/plugins/claude-code/straion-plugin/hooks/session-end.jsdist/agent-integrations/plugins/cursor/straion-plugin/hooks/session-end.jsdist/agent-integrations/plugins/github-copilot/straion-plugin/hooks/session-end.js~/.copilot/session-state/<sessionId>/events.jsonl~/.straion/trajectories
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `straion setup` configures AI coding agents and installs bundled plugins.
- Bundled session-end hooks invoke `straion trajectory collect` with agent transcript paths.
- The collection command is gated by `STRAION_TRAJECTORIES_ENABLED=1` and is documented to write local trajectories.
Evidence against
- No npm lifecycle scripts are declared.
- Hook execution is installed through an explicit, interactive CLI setup path.
- Reviewed hooks use fixed `execFileSync` arguments; no shell interpolation or remote payload loading was found.
- No network transmission is shown on the transcript-collection path.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings
Source & flagged code
7 flaggeddist/agent-integrations/plugins/claude-code/straion-plugin/hooks/session-end.jsView file
8L9: const { execFileSync } = require('child_process');
L10:
High
Child Process
Package source references child process execution.
dist/agent-integrations/plugins/claude-code/straion-plugin/hooks/session-end.jsView on unpkg · L8dist/cli.jsView file
553contains invisible/control Unicode U+200E (left-to-right mark)
`),i;function a(e){return r.stack.push(e),t;function t(){r.stack.pop()}}}function xz(e){throw Error("Cannot handle value `"+e+"`, expected node")}function Sz(e){throw Error("Cannot handle unknown node `"+e.type+"`")}function Cz(e,t){if(e.ty
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/cli.jsView on unpkg · L553Findings
3 Critical5 High4 Medium3 Low
CriticalTrojan Source Unicodedist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processdist/agent-integrations/plugins/claude-code/straion-plugin/hooks/session-end.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumProtestware
MediumStructural Risk Force Deep Review
LowFilesystem
Low
Affected versions and remediation
This report applies to @straion/cli@0.0.28.
See all versions of @straion/cli for other recorded verdicts.
- Review the evidence and your use of @straion/cli@0.0.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.