registry / @straion/cli / 0.1.10

@straion/cli@0.1.10

> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Source inspection found an executable CLI without lifecycle scripts and agent setup behind an explicit command. The scanner hints do not establish malicious behavior in the inspected source.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the CLI setup command to configure selected coding agents.

Impact

No unconsented install-time mutation, credential transfer, or command-output exfiltration was established from the inspected source.

Mechanism

The setup flow installs Straion integrations or skills in local agent configuration locations; the reviewed Copilot plugin step checks for the Copilot CLI first.

AI rationale

Source inspection found an executable CLI without lifecycle scripts and agent setup behind an explicit command. The scanner hints do not establish malicious behavior in the inspected source.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines a CLI executable and no lifecycle scripts.
The agent configuration code maps to local Claude, Cursor, and OpenCode paths.
Copilot plugin installation is in agent setup code and runs only when the Copilot CLI is available.
The setup command is an explicit CLI action with named-agent or interactive selection.
The setup module exposes integration setup behavior; no automatic install-time trigger was found.
Automode reads an environment or configuration setting to determine whether it is enabled.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 13 file(s), 1.68 MB of source, external domains: api.straion.app, commonmark.org, en.wikipedia.org, eu-assets.i.posthog.com, eu.i.posthog.com, github.com, json-schema.org, posthog.com, raw.githubusercontent.com, react.dev, sentry.io, straion.com, us-assets.i.posthog.com, us.i.posthog.com, www.w3.org, yandex.com, yarnpkg.com

Source & flagged code

6 flagged

dist/run-DekvQas3.jsView file

High

Child Process

Package source references child process execution.

dist/run-DekvQas3.jsView on unpkg · L1

1!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)... L2: `)}})),z=m((e=>{Object.defineProperty(e,"__esModule",{value:!0}),e.GraphQLError=void 0,e.formatError=s,e.printError=o;var t=nt(),n=rt(),r=it();function i(e){let t=e[0];return t==nu... ... L9: `,size:2};case 114:return{value:`\r`,size:2};case 116:return{value:` `,size:2}}throw(0,t.syntaxError)(e.source,n,`Invalid character escape sequence: "${r.slice(n,n+2)}".`)}function... L10: `));return e.line+=h.length-1,e.lineStart=l,t}if(o===92&&i.charCodeAt(u+1)===34&&i.charCodeAt(u+2)===34&&i.charCodeAt(u+3)===34){m+=i.slice(p,u),p=u+1,u+=4;continue}if(o===10||o===... L11: ... L15: L16: https://yarnpkg.com/en

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/run-DekvQas3.jsView on unpkg · L1

Findings

1 Critical5 High3 Medium4 Low

CriticalTrojan Source Unicodedist/run-agent-setup-Pfdw8IU1.js

HighChild Processdist/run-DekvQas3.js

HighSame File Env Network Executiondist/run-DekvQas3.js

HighCommand Output Exfiltrationdist/automode-Cg2-OeYU.js

HighCross File Remote Execution Contextdist/automode-Cg2-OeYU.js

HighTrigger Reachable Command Output Exfiltrationdist/automode-Cg2-OeYU.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @straion/cli@0.1.10.

See all versions of @straion/cli for other recorded verdicts.

Review the evidence and your use of @straion/cli@0.1.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 14:36:05.418Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @straion/cli / 0.1.10

@straion/cli@0.1.10

> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Source inspection found an executable CLI without lifecycle scripts and agent setup behind an explicit command. The scanner hints do not establish malicious behavior in the inspected source.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the CLI setup command to configure selected coding agents.

Impact

No unconsented install-time mutation, credential transfer, or command-output exfiltration was established from the inspected source.

Mechanism

The setup flow installs Straion integrations or skills in local agent configuration locations; the reviewed Copilot plugin step checks for the Copilot CLI first.

AI rationale

Source inspection found an executable CLI without lifecycle scripts and agent setup behind an explicit command. The scanner hints do not establish malicious behavior in the inspected source.

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest defines a CLI executable and no lifecycle scripts.
The agent configuration code maps to local Claude, Cursor, and OpenCode paths.
Copilot plugin installation is in agent setup code and runs only when the Copilot CLI is available.
The setup command is an explicit CLI action with named-agent or interactive selection.
The setup module exposes integration setup behavior; no automatic install-time trigger was found.
Automode reads an environment or configuration setting to determine whether it is enabled.

Evidence against

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

dist/run-DekvQas3.jsView file

High

Child Process

Package source references child process execution.

dist/run-DekvQas3.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/run-DekvQas3.jsView on unpkg · L1

Findings

1 Critical5 High3 Medium4 Low

CriticalTrojan Source Unicodedist/run-agent-setup-Pfdw8IU1.js

HighChild Processdist/run-DekvQas3.js

HighSame File Env Network Executiondist/run-DekvQas3.js

HighCommand Output Exfiltrationdist/automode-Cg2-OeYU.js

HighCross File Remote Execution Contextdist/automode-Cg2-OeYU.js

HighTrigger Reachable Command Output Exfiltrationdist/automode-Cg2-OeYU.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @straion/cli@0.1.10.

See all versions of @straion/cli for other recorded verdicts.

Review the evidence and your use of @straion/cli@0.1.10 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 14:36:05.418Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.