@swirls/cli@0.1.136
Swirls command line application
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe published postinstall clearly fetches and runs a first-party remote installer, which is unresolved install-time remote execution rather than a complete malware chain. Domain, global-only guards, and unobfuscated CLI structure make a publish block too likely to be a false positive.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm or bun global install of @swirls/cli (skipped for local installs, CI, and Windows).
Impact
The installing user runs whatever swirls.ai/install returns, and a native binary may overwrite bin/swirls and land in ~/.local/bin/swirls.
Mechanism
install-time curl piped to bash, then binary copy
AI rationale
The published postinstall clearly fetches and runs a first-party remote installer, which is unresolved install-time remote execution rather than a complete malware chain. Domain, global-only guards, and unobfuscated CLI structure make a publish block too likely to be a false positive.
Evidence
package.jsonscripts/install.jsbin/swirls~/.local/bin/swirls
Network endpoints1
swirls.ai/install
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- postinstall runs node scripts/install.js on install.
- Global installs pipe https://swirls.ai/install into bash through child_process execSync.
- After the remote script, the installer copies ~/.local/bin/swirls over the package bin/swirls binary.
- The shipped bin/swirls placeholder tells users to drop --ignore-scripts or run the same curl-to-bash installer.
Evidence against
- swirls.ai matches the scoped package name, author URL, and documented CLI product.
- The hook exits immediately unless the install is global npm or bun; CI and Windows are skipped.
- Published source is short and unobfuscated, with no secret harvesting, eval, agent-config writes, or runtime self-dependency.
- Scanner malware-fingerprint labels are not backed by extra hidden payload in this tarball.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
UrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/install.jsView file
13L14: import { execSync } from 'node:child_process'
L15: import { chmodSync, copyFileSync, existsSync } from 'node:fs'
...
L18:
L19: const INSTALL_URL = 'https://swirls.ai/install'
L20:
...
L28: const INSTALLED_BINARY = join(
L29: process.env.HOME || process.env.USERPROFILE || '',
L30: '.local',
...
L36:
L37: if (process.env.CI === 'true' || process.env.CI === '1') {
L38: process.exit(0)
Critical
Download Execute
Source downloads or fetches remote code and executes it.
Findings
2 Critical7 High3 Medium4 Low
CriticalDownload Executescripts/install.js
CriticalTrigger Reachable Dangerous Capabilityscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/install.js
HighShellscripts/install.js
HighSandbox Evasion Gated Capabilityscripts/install.js
HighSemantic Analysis Limitedbin/swirls
HighKnown Malware Source Similarityscripts/install.js
HighKnown Malware Source Fingerprint Signaturescripts/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @swirls/cli@0.1.136.
See all versions of @swirls/cli for other recorded verdicts.
- Review the evidence and your use of @swirls/cli@0.1.136 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.