registry / @straion/cli / 0.1.17
@straion/cli@0.1.17
> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and the flagged process runner inherits output to the terminal. The first-party agent-integration silent-upgrade behavior leaves a guarded lifecycle risk, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the CLI when its agent integrations are stale.
Impact
The CLI may update its bundled agent integrations during runtime.
Mechanism
The setup code checks integration status and can invoke a silent upgrade path.
AI rationale
The package has no install lifecycle hook, and the flagged process runner inherits output to the terminal. The first-party agent-integration silent-upgrade behavior leaves a guarded lifecycle risk, so a warning is appropriate.
Evidence
dist/run-agent-setup-CZWD71wO.jsdist/whoami-BTosFQ6b.js
Decision evidence
public snapshotAI called this Suspicious at 77.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a CLI entrypoint and contains no lifecycle script.
- The flagged process spawning code passes child output through to the terminal.
- The runtime includes agent-integration setup code with a silent-upgrade path when integrations are stale.
- The agent integrations are stored under the CLI’s bundled integration directory.
Evidence against
- The inspected source does not establish credential collection, unrelated data transmission, or a concrete attack.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggeddist/automode-A_VtOuD3.jsView file
1!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L2: `)}displayWidth(e){return u(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe...
High
Child Process
Package source references child process execution.
dist/automode-A_VtOuD3.jsView on unpkg · L112Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e...
L13: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(...
L14: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L18: `),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in l.env...
L19: Expecting one of '${n.join(`', '`)}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/automode-A_VtOuD3.jsView on unpkg · L12Findings
6 High2 Medium4 Low
HighChild Processdist/automode-A_VtOuD3.js
HighSame File Env Network Executiondist/automode-A_VtOuD3.js
HighCommand Output Exfiltrationdist/automode-A_VtOuD3.js
HighCross File Remote Execution Contextdist/automode-A_VtOuD3.js
HighTrigger Reachable Command Output Exfiltrationdist/automode-A_VtOuD3.js
HighSemantic Analysis Limiteddist/run-agent-setup-CZWD71wO.js
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @straion/cli@0.1.17.
See all versions of @straion/cli for other recorded verdicts.
- Review the evidence and your use of @straion/cli@0.1.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.