registry / AI-agent control-surface risk / @tier0/cli
@tier0/cli
Tier0 CLI — Unified Namespace data platform command line tool
This report shows the evidence for @tier0/cli@0.6.5. 1 of 3 known versions is blocked or flagged. The newest version, 0.7.1, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is unconsented postinstall mutation of foreign/broad AI-agent environments, coupled with remote native payload installation. The source establishes the behavior directly.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install / postinstall
Impact
A package installation can introduce unreviewed instructions/extensions into detected Codex, Claude Code, and Cursor environments.
Mechanism
remote binary installation plus global agent-skill registration
Policy narrative
The postinstall hook fetches a platform-native release archive from GitHub, verifies it using a checksum fetched from the same release location, extracts it, and executes the binary for version verification. It then copies a downloaded skill and invokes a global skills installer. The README confirms this targets detected Codex, Claude Code, and Cursor agents, so ordinary dependency installation can alter broad external agent control surfaces.
AI rationale
This is unconsented postinstall mutation of foreign/broad AI-agent environments, coupled with remote native payload installation. The source establishes the behavior directly.
Evidence
package.jsonlib/install.jsREADME.md~/.tier0/bin/tier0~/.tier0/bin/.version~/.tier0/skills/
Network endpoints1
github.com/FREEZONEX/Tier0-cli/releases/download/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs lib/install.js automatically in postinstall.
- lib/install.js downloads and executes a release binary during postinstall.
- lib/install.js extracts a downloaded SKILL.md into ~/.tier0/skills.
- lib/install.js automatically runs global `skills add` for detected agents.
- README.md states it copies skills to Codex, Claude Code, and Cursor.
Evidence against
- Release version is pinned to the npm package version.
- Downloaded archive is SHA-256 checked, though the checksum is fetched from the same release host.
- No source evidence of credential harvesting or arbitrary data exfiltration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node lib/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg4scripts.postinstall = node lib/install.js
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L4: const path = require('path');
L5: const https = require('https');
L6: const crypto = require('crypto');
L7: const { execFileSync, execSync, spawn } = require('child_process');
L8:
...
L62: } else {
L63: fs.copyFileSync(srcPath, dstPath);
L64: }
...
L70: return new Promise((resolve, reject) => {
L71: const file = fs.createWriteStream(dest);
L72: https.get(url, { timeout: 300000 }, (res) => {
L73: if (res.statusCode === 302 || res.statusCode === 301) {
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4•scripts.postinstall = node lib/install.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
Findings
2 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighUnverified Remote Native Payload Installpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tier0/cli@0.6.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing @tier0/cli@0.6.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.