registry / AI-agent control-surface risk / @tigrisdata/cli

@tigrisdata/cli

Command line interface for Tigris object storage

This report shows the evidence for @tigrisdata/cli@3.11.0. 1 of 13 known versions is blocked or flagged. The newest version, 3.17.1, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an automatic postinstall mutation of a foreign AI-agent control surface, not an explicit user-command setup flow. The hook installs behavioral instructions that influence future agent actions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the postinstall hook when the user's .claude directory exists.

Impact

Future Claude Code sessions can be influenced to use Tigris for object-storage tasks without the user's explicit setup action.

Mechanism

Automatic installation of a Claude Code skill into the user's home directory.

Policy narrative

The package registers a postinstall lifecycle hook. On dependency installation, it detects an existing Claude Code directory and copies its bundled non-user-invocable skill into the user's global Claude skills directory. That skill instructs the agent to use Tigris for all object-storage tasks, creating an unconsented cross-session agent control surface.

AI rationale

Evidence

package.jsonpostinstall.cjsSKILL.md.claude/skills/tigris/SKILL.md

Network endpoints1

t3.storage.dev

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest runs postinstall automatically.
The install hook copies a package skill into the user's Claude Code skills directory when .claude exists.
The installed skill is non-user-invocable and directs the agent to prefer Tigris for all object-storage work.

Evidence against

The hook does not show credential collection, network access, or shell execution.
Other agent configuration changes are behind the interactive tigris init command.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 158 file(s), 222 KB of source, external domains: community.tigrisdata.com, fly.io, get.t3.storage.dev, iam.storageapi.dev, mcp.storage.dev, mgmt.storageapi.dev, ph.tigrisdata.com, pkg.go.dev, registry.npmjs.org, t3.storage.dev, www.tigrisdata.com

Source & flagged code

5 flagged

package.jsonView file

Lines 48-77json

48 "yaml": "^2.8.3",

49 "@tigrisdata/iam": "^2.5.0",

50 "@tigrisdata/storage": "^3.21.0"

51 },

52 "devDependencies": {

53 "tsx": "^4.21.0"

54 },

55 "scripts": {

56 "build": "tsc --noEmit && tsup",

57 "dev": "export $(grep -v '^#' .env.test | xargs) && (tsc --noEmit --watch --preserveWatchOutput & tsup --watch)",

58 "cli": "export $(grep -v '^#' .env.test | xargs) && node dist/cli.js",

59 "lint": "biome lint",

60 "lint:fix": "biome lint --write",

61 "format": "biome format --write",

62 "format:check": "biome format",

63 "test": "vitest run",

64 "test:watch": "vitest",

65 "test:integration": "vitest run test/cli.test.ts",

66 "publint": "publint",

67 "updatedocs": "tsx scripts/update-docs.ts",

68 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L68

High

Suspicious Lifecycle Evidence

The manifest runs postinstall automatically.

package.jsonView on unpkg · L68

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L68

69 "generate:registry": "tsx scripts/generate-registry.ts",

70 "build:binary": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && tsx scripts/build-binaries.ts",

71 "build:binary:current": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && bun build src/cli-binary.ts --compile --outfile=bin/tigris",

72 "dev:binary": "npm run generate:registry && tsc --noEmit --watch --preserveWatchOutput -p tsconfig.binary.json & bun build src/cli-binary.ts --compile --watch --outfile=bin/tigris",

73 "clean": "rm -rf dist",

74 "check": "biome check",

75 "check:fix": "biome check --write"

76 }

77}

dist/chunk-Z5DYQHN2.jsView file

Lines 1-2javascript

1import{e as l}from"./chunk-KJXUEGXY.js";import{a as m,k as s}from"./chunk-TVH7NCXE.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-Z54TMLIH.js"

postinstall.cjsView file

Lines 1-21javascript

1const { openSync, writeSync, closeSync, mkdirSync, copyFileSync, existsSync } = require('fs');

2const { join } = require(

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

68"postinstall": "node postinstall.cjs",

High

Suspicious Lifecycle Evidence

The manifest runs postinstall automatically.

package.jsonView on unpkg · L68

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-Z5DYQHN2.jsView file

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackpostinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-Z5DYQHN2.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @tigrisdata/cli@3.11.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @tigrisdata/cli@3.11.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-01 14:45:15.311Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

13 known versions

3.17.1latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 22, 2026, 11:26 AM 3.17.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 13, 2026, 7:21 AM 3.16.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 8, 2026, 12:38 PM 3.15.0SuspiciousAgent extension lifecycle riskWarnPublishedOct 6, 2026, 2:58 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code