registry / @tiens.nguyen/gu-cli / 1.0.699
@tiens.nguyen/gu-cli@1.0.699
Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection shows a package-aligned CLI postinstall that conditionally updates PATH, plus ordinary worker, model-provider, and proxy behavior. The inspected code does not establish a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install runs the postinstall hook; the persistent change occurs only when the global npm bin directory is absent from PATH.
Impact
A shell profile may be modified to make the installed CLI available in future terminals; inspected behavior does not establish credential theft or remote execution.
Mechanism
The installer appends a marked PATH export block to existing shell configuration files; reviewed network and proxy code supports the CLI's model and worker functions.
AI rationale
Source inspection shows a package-aligned CLI postinstall that conditionally updates PATH, plus ordinary worker, model-provider, and proxy behavior. The inspected code does not establish a concrete malicious chain.
Evidence
~/.zshrc~/.bashrc~/.bash_profile~/.profile
Decision evidence
public snapshotAI called this Clean at 85.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json maps the CLI commands to the package's own entrypoints and runs install-path.mjs at postinstall.
- gu-cli.mjs loads the worker key from its documented local worker environment file and process environment.
- coding-provider-setup.mjs rejects embedded URL credentials to avoid storing or displaying them.
- proxy-dispatcher.mjs routes requests through a proxy only for configured model endpoints when enabled.
- client-expert-run.mjs performs model-list requests as part of local client functionality.
- install-path.mjs updates shell PATH only when the global npm bin directory is missing from PATH.
Evidence against
- The postinstall hook makes a conditional, persistent shell profile change; inspected code appends a PATH export block for the global npm bin directory.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node install-path.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgproxy-selftest.mjsView file
195patternName = generic_password
severity = medium
line = 195
Medium
gu-cli.mjsView file
18import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
L19: import { execFile as execFileCallback, spawn } from "node:child_process";
L20: import { createHash } from "node:crypto";
High
Findings
8 High5 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processgu-cli.mjs
HighShellgu-cli.mjs
HighSame File Env Network Executiongu-cli.mjs
HighCloud Metadata Accesscoding-provider-setup.mjs
HighCopied Package Dependency Bridgeproxy-dispatcher.mjs
HighSemantic Analysis Limitedclient-expert-run.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltagu-cli.mjs
MediumSecret Patternproxy-selftest.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpergonext_transcribe.py
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @tiens.nguyen/gu-cli@1.0.699.
See all versions of @tiens.nguyen/gu-cli for other recorded verdicts.
- Review the evidence and your use of @tiens.nguyen/gu-cli@1.0.699 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.