@tigrisdata/cli@3.12.0

Command line interface for Tigris object storage

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs unconsented install-time mutation of a global AI-agent extension surface. The mutation is narrowly scoped to a same-vendor skill and no concrete exfiltration or remote-payload behavior was confirmed.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation when ~/.claude already exists.

Impact

Claude Code may receive Tigris-preference instructions automatically.

Mechanism

Postinstall copies a global agent skill.

AI rationale

Evidence

package.jsonpostinstall.cjsSKILL.md~/.claude/skills/tigris/SKILL.md/dev/tty

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Installation automatically runs a postinstall script.
The postinstall script copies a non-user-invocable Tigris skill into the existing global Claude directory.
The installed skill directs the agent to prefer Tigris over AWS S3 commands for all object-storage tasks.

Evidence against

The hook only acts when an existing ~/.claude directory is present and copies one same-vendor skill.
No install-time network request, credential collection, command download, or self-dependency was found.
The browser OAuth code uses Tigris authentication domains; no fixed unofficial credential gateway was confirmed.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

8 flagged

package.jsonView file

Lines 62-93json

62 "events": "^3.3.0",

63 "memfs": "^4.68.1",

64 "path-browserify": "^1.0.1",

65 "stream-browserify": "^3.0.0",

66 "tsx": "^4.21.0",

67 "util": "^0.12.5"

68 },

69 "scripts": {

70 "build": "tsc --noEmit && tsup && npm run build:browser",

71 "dev": "export $(grep -v '^#' .env.test | xargs) && (tsc --noEmit --watch --preserveWatchOutput & tsup --watch)",

72 "cli": "export $(grep -v '^#' .env.test | xargs) && node dist/cli.js",

73 "lint": "biome lint",

74 "lint:fix": "biome lint --write",

75 "format": "biome format --write",

76 "format:check": "biome format",

77 "test": "vitest run",

78 "test:watch": "vitest",

79 "test:integration": "vitest run test/cli.test.ts",

80 "publint": "publint",

81 "updatedocs": "tsx scripts/update-docs.ts",

82 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "generate:registry": "tsx scripts/generate-registry.ts",

84 "build:binary": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && tsx scripts/build-binaries.ts",

85 "build:binary:current": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && bun build src/cli-binary.ts --compile --outfile=bin/tigris",

86 "dev:binary": "npm run generate:registry && tsc --noEmit --watch --preserveWatchOutput -p tsconfig.binary.json & bun build src/cli-binary.ts --compile --watch --outfile=bin/tigris",

87 "clean": "rm -rf dist",

88 "check": "biome check",

89 "check:fix": "biome check --write",

90 "generate:registry:browser": "tsx scripts/generate-registry.ts --target=browser",

91 "build:browser": "npm run generate:registry:browser && tsc --noEmit -p tsconfig.browser.json && tsx scripts/build-browser.ts && tsup --config tsup.browser.config.ts"

92 }

93}

dist/chunk-NPKVQONE.jsView file

Lines 1-2javascript

1import{e as l}from"./chunk-UR3ROJIV.js";import{a as m,k as s}from"./chunk-DM3Z47H2.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-T7LA7K35.js"

dist/browser/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/browser/index.js: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... `+t);Zy.printJson=Fte});var gB=z(Sp=>{"use strict";f();d();l();Object.defineProperty(Sp,"__esModule",{value:!0});var Tv=(vi(),Mn(io));Tv.__exportStar(pB(),Sp);Tv.__exportStar(mB(),... `;case"\\r":return"\r";case"\\t":return" ";case'\\"':return'"';case"\\/":return"/";case"\\\\":return"\\"}return t},tL=(t,e)=>t[e]===100&&t[e+1]===97&&t[e+2]===116&&t[e+3]===97&&t[e... `),GL()||r("")})},close(){},on(){return t}};return t}var VL=U(()=>{"

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/browser/index.jsView on unpkg

postinstall.cjsView file

Lines 1-21javascript

1const { openSync, writeSync, closeSync, mkdirSync, copyFileSync, existsSync } = require('fs');

2const { join } = require(

dist/chunk-7UKHARLH.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/chunk-7UKHARLH.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-7UKHARLH.jsView on unpkg

dist/lib/update.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/lib/update.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/update.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-NPKVQONE.jsView file

1import{e as l}from"./chunk-UR3ROJIV.js";import{a as m,k as s}from"./chunk-DM3Z47H2.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-T7LA7K35.js";import{exists...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-NPKVQONE.jsView on unpkg · L1

Findings

1 Critical5 High6 Medium4 Low

CriticalAi Agent Control Hijackpostinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/browser/index.js

HighKnown Malware Source Similaritydist/chunk-7UKHARLH.js

HighKnown Malware Source Similaritydist/lib/update.js

HighKnown Malware Source Similaritypostinstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-NPKVQONE.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @tigrisdata/cli@3.12.0.

See all versions of @tigrisdata/cli for other recorded verdicts.

Review the evidence and your use of @tigrisdata/cli@3.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 17:29:45.127Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code