registry / @straion/cli / 0.1.13

@straion/cli@0.1.13

> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook or concrete attack behavior. The scanner’s execution and network signals correspond to CLI setup and rule-context delivery to supported agents.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the CLI or invoking its agent session-start hook.

Impact

No malicious impact was established.

Mechanism

The hook fetches rule-index data from Straion’s service and writes that context to the agent hook output; inspected code does not disclose captured command output.

AI rationale

Source inspection found no install lifecycle hook or concrete attack behavior. The scanner’s execution and network signals correspond to CLI setup and rule-context delivery to supported agents.

Network endpoints1

api.straion.app

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a command-line executable; no lifecycle hook appears in the inspected manifest.
Agent integration setup is an explicit CLI command that passes selected agent IDs to setup handlers.
The setup interface requires the user to select agents before submitting the selection.
Runtime source maps agent integrations to user configuration directories.
The session-start hook fetches Straion rule-index data, writes it to agent context, and tracks agent and rule-count metadata; it does not send captured command output in the inspected handler.
The authenticated API client uses api.straion.app as its default service endpoint.
Analytics initializes a PostHog client at us.i.posthog.com and can be disabled with STRAION_ANALYTICS_DISABLED=1.

Evidence against

Scanner labels describe command execution and network behavior, but inspected source ties those behaviors to CLI and agent-integration features rather than a concrete attack.

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Source & flagged code

6 flagged

dist/run-1lcNmapW.jsView file

High

Child Process

Package source references child process execution.

dist/run-1lcNmapW.jsView on unpkg · L1

1!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)... L2: `)}})),z=m((e=>{Object.defineProperty(e,"__esModule",{value:!0}),e.GraphQLError=void 0,e.formatError=s,e.printError=o;var t=nt(),n=rt(),r=it();function i(e){let t=e[0];return t==nu... ... L9: `,size:2};case 114:return{value:`\r`,size:2};case 116:return{value:` `,size:2}}throw(0,t.syntaxError)(e.source,n,`Invalid character escape sequence: "${r.slice(n,n+2)}".`)}function... L10: `));return e.line+=h.length-1,e.lineStart=l,t}if(o===92&&i.charCodeAt(u+1)===34&&i.charCodeAt(u+2)===34&&i.charCodeAt(u+3)===34){m+=i.slice(p,u),p=u+1,u+=4;continue}if(o===10||o===... L11: ... L15: L16: https://yarnpkg.com/en

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/run-1lcNmapW.jsView on unpkg · L1

Findings

1 Critical5 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands-BOR4ippN.js

HighChild Processdist/run-1lcNmapW.js

HighSame File Env Network Executiondist/run-1lcNmapW.js

HighCommand Output Exfiltrationdist/automode-c8t4q6-6.js

HighCross File Remote Execution Contextdist/automode-c8t4q6-6.js

HighTrigger Reachable Command Output Exfiltrationdist/automode-c8t4q6-6.js

MediumNetwork

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @straion/cli@0.1.13.

See all versions of @straion/cli for other recorded verdicts.

Review the evidence and your use of @straion/cli@0.1.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 12:20:55.974Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / @straion/cli / 0.1.13

@straion/cli@0.1.13

> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Source inspection found no install lifecycle hook or concrete attack behavior. The scanner’s execution and network signals correspond to CLI setup and rule-context delivery to supported agents.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the CLI or invoking its agent session-start hook.

Impact

No malicious impact was established.

Mechanism

The hook fetches rule-index data from Straion’s service and writes that context to the agent hook output; inspected code does not disclose captured command output.

AI rationale

Source inspection found no install lifecycle hook or concrete attack behavior. The scanner’s execution and network signals correspond to CLI setup and rule-context delivery to supported agents.

Network endpoints1

api.straion.app

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest exposes a command-line executable; no lifecycle hook appears in the inspected manifest.
Agent integration setup is an explicit CLI command that passes selected agent IDs to setup handlers.
The setup interface requires the user to select agents before submitting the selection.
Runtime source maps agent integrations to user configuration directories.
The session-start hook fetches Straion rule-index data, writes it to agent context, and tracks agent and rule-count metadata; it does not send captured command output in the inspected handler.
The authenticated API client uses api.straion.app as its default service endpoint.
Analytics initializes a PostHog client at us.i.posthog.com and can be disabled with STRAION_ANALYTICS_DISABLED=1.

Evidence against

Scanner labels describe command execution and network behavior, but inspected source ties those behaviors to CLI and agent-integration features rather than a concrete attack.

Behavioral surface

Source

ChildProcessEnvironmentVarsEval

Source & flagged code

6 flagged

dist/run-1lcNmapW.jsView file

High

Child Process

Package source references child process execution.

dist/run-1lcNmapW.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/run-1lcNmapW.jsView on unpkg · L1

Findings

1 Critical5 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands-BOR4ippN.js

HighChild Processdist/run-1lcNmapW.js

HighSame File Env Network Executiondist/run-1lcNmapW.js

HighCommand Output Exfiltrationdist/automode-c8t4q6-6.js

HighCross File Remote Execution Contextdist/automode-c8t4q6-6.js

HighTrigger Reachable Command Output Exfiltrationdist/automode-c8t4q6-6.js

MediumNetwork

MediumEnvironment Vars

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @straion/cli@0.1.13.

See all versions of @straion/cli for other recorded verdicts.

Review the evidence and your use of @straion/cli@0.1.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 12:20:55.974Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.