registry / @tier0/cli / 0.7.1
@tier0/cli@0.7.1
Tier0 CLI — Unified Namespace data platform command line tool
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe code establishes an automatic remote-binary and first-party agent-extension lifecycle, but does not show theft, destructive action, stealth persistence, or a self-dependency chain. This is a guarded lifecycle risk rather than proven malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall, or invoking the CLI when its managed binary is absent
Impact
A released remote binary runs locally and can create the Tier0 agent extension.
Mechanism
native binary download followed by global agent-skill installation
AI rationale
The code establishes an automatic remote-binary and first-party agent-extension lifecycle, but does not show theft, destructive action, stealth persistence, or a self-dependency chain. This is a guarded lifecycle risk rather than proven malware.
Evidence
package.jsonlib/install.jsbin/tier0.jslib/uninstall.js~/.tier0/bin/tier0~/.tier0/bin/.version~/.tier0/skills~/.agents/skills/tier0
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The postinstall hook automatically runs the downloader.
- The installer downloads and executes a released native binary, then globally installs an agent skill.
- The CLI invokes installation when the managed binary is absent.
Evidence against
- The downloaded archive is checked against a SHA-256 checksum before extraction.
- No source code reads or transmits credentials, environment values, or arbitrary user files.
- The uninstall hook removes agent skills only when the user supplies --remove-skills.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node lib/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg4scripts.postinstall = node lib/install.js
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L4: const path = require('path');
L5: const https = require('https');
L6: const crypto = require('crypto');
L7: const { execFileSync, execSync } = require('child_process');
L8:
...
L42: return new Promise((resolve, reject) => {
L43: const file = fs.createWriteStream(dest);
L44: https.get(url, { timeout: 300000 }, (res) => {
L45: if (res.statusCode === 302 || res.statusCode === 301) {
L46: file.close();
L47: fs.unlinkSync(dest);
L48: return downloadFile(res.headers.location, dest).then(resolve).catch(reject);
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
Findings
1 Critical4 High4 Medium5 Low
CriticalAi Agent Control Hijacklib/uninstall.js
HighInstall Time Lifecycle Scriptspackage.json
HighUnverified Remote Native Payload Installpackage.json
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similaritybin/tier0.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tier0/cli@0.7.1.
See all versions of @tier0/cli for other recorded verdicts.
- Review the evidence and your use of @tier0/cli@0.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.