registry / @straion/cli / 0.1.18
@straion/cli@0.1.18
> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the CLI’s inspected subprocess behavior is tied to its Git notes feature. The scanner’s execution and network signals do not establish an attack in the inspected source.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI or configures its audit trail feature for Git pushes.
Impact
No unconsented install-time execution, credential theft, or unrelated control-surface mutation was established.
Mechanism
The audit hook launches the CLI to share authorship notes with the Git remote associated with the push; setup is performed through the CLI command.
AI rationale
The manifest has no install lifecycle hook, and the CLI’s inspected subprocess behavior is tied to its Git notes feature. The scanner’s execution and network signals do not establish an attack in the inspected source.
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines a CLI entrypoint and contains no lifecycle script.
- whoami registers agent integrations for the CLI to configure.
- commands exposes setup as a user-run command with optional agent selection.
- run-agent-setup checks agent installation and setup status as part of integration setup.
- audit launches the share-notes command only after the trail feature is enabled and a pushed ref is found.
- automode’s child_process import is part of the bundled CLI dependencies; inspected command execution is tied to the Git notes feature.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/automode-BDY_RuhW.jsView file
1!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L2: `)}displayWidth(e){return u(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe...
High
Child Process
Package source references child process execution.
dist/automode-BDY_RuhW.jsView on unpkg · L112Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e...
L13: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(...
L14: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L18: `),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in l.env...
L19: Expecting one of '${n.join(`', '`)}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/automode-BDY_RuhW.jsView on unpkg · L12Findings
1 Critical6 High2 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/audit-DyjhOmxF.js
HighChild Processdist/automode-BDY_RuhW.js
HighSame File Env Network Executiondist/automode-BDY_RuhW.js
HighCommand Output Exfiltrationdist/automode-BDY_RuhW.js
HighCross File Remote Execution Contextdist/automode-BDY_RuhW.js
HighTrigger Reachable Command Output Exfiltrationdist/automode-BDY_RuhW.js
HighSemantic Analysis Limiteddist/audit-DyjhOmxF.js#virtual:string-array:round1
MediumNetwork
MediumEnvironment Vars
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @straion/cli@0.1.18.
See all versions of @straion/cli for other recorded verdicts.
- Review the evidence and your use of @straion/cli@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.