@tier0/cli@0.6.9

Tier0 CLI — Unified Namespace data platform command line tool

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source establishes a package-aligned remote bootstrap and first-party global agent-skill setup during postinstall. That warrants a warning, not a malware block, because no concrete malicious behavior was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall, or invoking the tier0 CLI when its binary is absent.

Impact

A compromised release/checksum source could execute a native payload; postinstall can alter agent-skill state.

Mechanism

remote native-binary bootstrap plus first-party agent-skill installation

AI rationale

Evidence

package.jsonlib/install.jslib/uninstall.jsbin/tier0.js~/.tier0/bin/tier0~/.tier0/bin/.version~/.tier0/skillssystem temporary directory~/.agents/skills/tier0

Network endpoints1

github.com/FREEZONEX/Tier0-cli/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

postinstall runs a downloader and installer.
It downloads, extracts, and executes a native binary from GitHub releases.
Postinstall materializes and globally installs a Tier0 agent skill via npx.

Evidence against

The download path is fixed to the declared Tier0 repository and has SHA-256 checking.
No source reads credentials, harvests environment secrets, or exfiltrates data.
Agent-skill removal is opt-in during uninstall; it is preserved by default.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 21.2 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node lib/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node lib/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const path = require('path'); L5: const https = require('https'); L6: const crypto = require('crypto'); L7: const { execFileSync, execSync } = require('child_process'); L8: ... L42: return new Promise((resolve, reject) => { L43: const file = fs.createWriteStream(dest); L44: https.get(url, { timeout: 300000 }, (res) => { L45: if (res.statusCode === 302 || res.statusCode === 301) { L46: file.close(); L47: fs.unlinkSync(dest); L48: return downloadFile(res.headers.location, dest).then(resolve).catch(reject);

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node lib/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/uninstall.jsView file

11Install-time code directly mutates a foreign AI-agent control surface: L11: const CONFIG_FILE = path.join(TIER0_DIR, 'config.json'); L12: const AGENT_SKILL_DIR = path.join(os.homedir(), '.agents', 'skills', 'tier0'); L13: const NPM_PACKAGE = '@tier0/cli'; Write operation from lib/install.js: L206: if (platform !== 'win32') { L207: fileSystem.copyFileSync(sourcePath, binaryPath); L208: fileSystem.chmodSync(binaryPath, 0o755); ... L236: } L237: fileSystem.copyFileSync(sourcePath, stagedPath); L238: if (fileSystem.existsSync(binaryPath)) { ... L320: if (!fs.existsSync(binDir)) { L321: fs.mkdirSync(binDir, { recursive: true }); L322: } ... L340: const extractDir = path.join(tmpDir, `tier0-extract-${Date.now()}`); L341: fs.mkdirSync(extractDir, { recursive: true }); L342: Foreign user/project

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/uninstall.jsView on unpkg · L11

bin/tier0.jsView file

•matchType = normalized_sha256 matchedPackage = @tier0/cli@0.6.5 matchedPath = bin/tier0.js matchedIdentity = npm:QHRpZXIwL2NsaQ:0.6.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/tier0.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node lib/install.js

Medium

Ambiguous Install Lifecycle Script

Findings

1 Critical3 High4 Medium5 Low

CriticalAi Agent Control Hijacklib/uninstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighUnverified Remote Native Payload Installpackage.json

HighKnown Malware Source Similaritybin/tier0.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @tier0/cli@0.6.9.

See all versions of @tier0/cli for other recorded verdicts.

Review the evidence and your use of @tier0/cli@0.6.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-17 09:58:55.386Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.