registry / Remote code execution / @swirls/cli
@swirls/cli
Swirls command line application
This report shows the evidence for @swirls/cli@0.1.128. 6 of 20 known versions are blocked or flagged. The newest version, 0.1.137, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete, unconsented install-time remote code execution, not merely a user-invoked downloader. Platform and global-install guards reduce reach but do not remove the attack surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Global installation of @swirls/cli on a non-Windows, non-CI host.
Impact
Remote server-controlled code executes with the installing user's permissions and installs a resulting binary.
Mechanism
postinstall remote shell download-and-execute
Attack narrative
During global installation, npm runs the declared postinstall hook. The hook invokes `curl -fsSL https://swirls.ai/install | bash` without a pinned artifact or integrity verification, so the endpoint can supply arbitrary shell commands that run as the installer. It then copies a produced binary into the package's `bin/swirls` path.
AI rationale
This is concrete, unconsented install-time remote code execution, not merely a user-invoked downloader. Platform and global-install guards reduce reach but do not remove the attack surface.
Evidence
package.jsonscripts/install.jsbin/swirlsbin/README.txt.local/bin/swirls
Network endpoints1
swirls.ai/install
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `postinstall` automatically invokes `scripts/install.js`.
- Global non-Windows installs download `https://swirls.ai/install` and pipe it directly to `bash`.
- The unpinned remote script can execute arbitrary installer-supplied commands.
- The downloaded binary is copied into the package's executable path.
Evidence against
- The lifecycle script exits in CI, Windows, and non-global installs.
- No credential harvesting, agent-control writes, or destructive commands are present in the shipped files.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
NoLicense
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.jsView file
13L14: import { execSync } from 'node:child_process'
L15: import { chmodSync, copyFileSync, existsSync } from 'node:fs'
...
L18:
L19: const INSTALL_URL = 'https://swirls.ai/install'
L20:
...
L28: const INSTALLED_BINARY = join(
L29: process.env.HOME || process.env.USERPROFILE || '',
L30: '.local',
...
L36:
L37: if (process.env.CI === 'true' || process.env.CI === '1') {
L38: process.exit(0)
Critical
Download Execute
Source downloads or fetches remote code and executes it.
Findings
2 Critical5 High3 Medium4 Low
CriticalDownload Executescripts/install.js
CriticalTrigger Reachable Dangerous Capabilityscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/install.js
HighShellscripts/install.js
HighSandbox Evasion Gated Capabilityscripts/install.js
HighKnown Malware Source Similarityscripts/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
Low
Affected versions and remediation
This report applies to @swirls/cli@0.1.128.
The versions list below shows the verdict for each recorded version.
- Avoid installing @swirls/cli@0.1.128. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.