registry / @straion/cli / 0.1.4
@straion/cli@0.1.4
> **Note:** This CLI is currently in early access. Features may change and we appreciate your feedback. For questions or issues, please contact [support@straion.com](mailto:support@straion.com).
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe manifest exposes a CLI without install lifecycle hooks, and the flagged integration command is explicitly user-invoked. The scanner's execution and network indicators are consistent with CLI support and analytics; inspected source did not establish an active attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the CLI and explicitly invoking its setup command; there is no npm lifecycle trigger in the manifest.
Impact
No confirmed unauthorized command-output exfiltration or install-time agent configuration mutation was established.
Mechanism
The inspected source selects audit mode from project settings or an environment variable and offers agent setup through a command that becomes interactive when no agent is specified.
AI rationale
The manifest exposes a CLI without install lifecycle hooks, and the flagged integration command is explicitly user-invoked. The scanner's execution and network indicators are consistent with CLI support and analytics; inspected source did not establish an active attack.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json defines a CLI binary and contains no lifecycle scripts.
- The indicated integration location names agent configuration paths; the source excerpt does not show a write or install operation.
- Audit mode is selected through a project-scoped setting or environment variable.
- Agent setup is exposed as an explicit CLI command with interactive setup when no agent is selected.
- The flagged audit bundle includes standard CLI process handling and PostHog analytics code; inspection found no confirmed command-output exfiltration path.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggeddist/audit-mode-BbP0k9ob.jsView file
1!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error)...
L2: `)}displayWidth(e){return u(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe...
High
Child Process
Package source references child process execution.
dist/audit-mode-BbP0k9ob.jsView on unpkg · L112Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e...
L13: - already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(...
L14: - either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValu...
...
L18: `),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in l.env...
L19: Expecting one of '${n.join(`', '`)}
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/audit-mode-BbP0k9ob.jsFindings
2 Critical5 High3 Medium4 Low
CriticalTrojan Source Unicodedist/run-agent-setup-B0vt9vwC.js
CriticalPrevious Version Dangerous Deltadist/commands-CMgspJQK.js
HighChild Processdist/audit-mode-BbP0k9ob.js
HighSame File Env Network Executiondist/audit-mode-BbP0k9ob.js
HighCommand Output Exfiltrationdist/audit-mode-BbP0k9ob.js
HighCross File Remote Execution Contextdist/audit-mode-BbP0k9ob.js
HighTrigger Reachable Command Output Exfiltrationdist/audit-mode-BbP0k9ob.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @straion/cli@0.1.4.
See all versions of @straion/cli for other recorded verdicts.
- Review the evidence and your use of @straion/cli@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.