registry / @swirls/cli / 0.1.118

@swirls/cli@0.1.118

Swirls command line application

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Global installation automatically downloads a remote script and pipes it to Bash. The downloaded script is unconstrained by the published package contents and can execute with the installing user's privileges.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Global npm or Bun installation that permits lifecycle scripts on non-Windows hosts outside CI.

Impact

Arbitrary remote code execution and replacement of the installed CLI binary.

Mechanism

postinstall remote shell download-and-execute

Attack narrative

During global installation, `postinstall` invokes an unverified remote URL through `curl | bash`. That remote response is executed immediately, then any binary it places at `$HOME/.local/bin/swirls` is copied over the package CLI entrypoint. This is an install-time remote-code-execution chain outside the inspected package artifact.

Rationale

The package contains an automatically triggered, unpinned remote shell execution path during installation. Guarding it to global non-CI, non-Windows environments narrows targets but does not remove the arbitrary-code-execution risk.

Evidence

package.jsonscripts/install.jsbin/swirlsbin/README.txt$HOME/.local/bin/swirls

Network endpoints1

swirls.ai/install

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `node scripts/install.js` as `postinstall`.
`scripts/install.js` executes `curl -fsSL https://swirls.ai/install | bash` via `execSync`.
The remote shell payload is unpinned and has no hash/signature verification.
The lifecycle hook runs automatically for global npm/Bun installs and copies its resulting binary into `bin/swirls`.

Evidence against

The script exits in CI, Windows, and non-global installations.
Inspected files show no credential harvesting or AI-agent configuration writes.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 1.35 KB of source, external domains: swirls.ai

Source & flagged code

9 flagged

package.jsonView file

Lines 1-41json

2 "name": "@swirls/cli",

3 "version": "0.1.118",

4 "description": "Swirls command line application",

5 "author": {

6 "name": "Swirls",

7 "url": "https://swirls.ai"

8 },

9 "type": "module",

10 "bin": {

11 "swirls": "./bin/swirls"

12 },

13 "files": [

14 "bin",

15 "scripts/install.js"

16 ],

17 "scripts": {

18 "build": "bun run scripts/build.ts",

19 "depcruise": "bun ../../.github/scripts/depcruise-workspace.mjs",

20 "dev": "bun run --watch src/bin/cli.ts",

21 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "bun test",

23 "test:coverage": "bun test --coverage --coverage-reporter=lcov --coverage-reporter=text",

24 "version": "bun run scripts/version.ts"

25 },

26 "devDependencies": {

27 "@byteslice/result": "0.3.0",

28 "@clack/prompts": "1.0.0",

29 "@elysiajs/eden": "1.4.8",

30 "@orpc/client": "1.13.14",

31 "@orpc/contract": "1.13.14",

32 "@stricli/core": "1.2.4",

33 "@swirls/agent": "0.0.1",

34 "@swirls/auth": "0.1.0",

35 "@swirls/contract": "0.0.1",

36 "@swirls/deploy": "0.0.1",

37 "@swirls/execution-events": "0.0.1",

38 "@swirls/language": "0.0.94",

39 "@swirls/registry": "0.0.1",

40 "@swirls/schemas": "0.0.1",

41 "@swirls/sdk": "1.1.5",

scripts/install.jsView file

Lines 1-60javascript

1#!/usr/bin/env node

3/**

4 * Runs the install script for platform detection and binary

5 * download, then copies the binary into bin/ so `swirls` runs the real

6 * binary (no Node wrapper).

7 *

8 * Skips installation in the following cases:

9 * - CI environment

10 * - Not installed globally

11 * - Windows (no curl/bash)

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install.jsView file

13L14: import { execSync } from 'node:child_process' L15: import { chmodSync, copyFileSync, existsSync } from 'node:fs' ... L18: L19: const INSTALL_URL = 'https://swirls.ai/install' L20: ... L28: const INSTALLED_BINARY = join( L29: process.env.HOME || process.env.USERPROFILE || '', L30: '.local', ... L36: L37: if (process.env.CI === 'true' || process.env.CI === '1') { L38: process.exit(0)

Critical

Download Execute

Source downloads or fetches remote code and executes it.

Findings

2 Critical6 High3 Medium4 Low

CriticalDownload Executescripts/install.js

CriticalTrigger Reachable Dangerous Capabilityscripts/install.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/install.js

HighShellscripts/install.js

HighSandbox Evasion Gated Capabilityscripts/install.js

HighKnown Malware Source Similarityscripts/install.js

HighKnown Malware Source Fingerprint Signaturescripts/install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Low