@tigrisdata/cli@3.12.1

Command line interface for Tigris object storage

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an automatic first-party agent-extension installation, which is a real lifecycle risk but does not establish concrete malware behavior. The suspicious scanner claims about credential redirection are not supported by the inspected source.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when the package is installed under node_modules and ~/.claude already exists.

Impact

Claude Code may load vendor-specific storage guidance without an explicit setup command.

Mechanism

Copies a bundled namespaced skill into a global Claude Code skills directory.

AI rationale

Evidence

package.jsonpostinstall.cjsSKILL.md~/.claude/skills/tigris/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs postinstall automatically.
Postinstall copies its bundled skill into an existing global Claude Code directory.
The copied skill directs agent use toward this vendor's storage CLI.

Evidence against

The lifecycle hook only creates a namespaced Tigris skill and shows a terminal banner; no credential or file exfiltration was found.
Agent MCP and skill configuration changes are performed by the explicit interactive tigris init command.
The flagged custom endpoint is a user-supplied configure option, not a fixed credential-redirection host.
No self-dependency, opaque payload download, or automatic broad agent-config rewrite was found.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareUrlStrings

Source & flagged code

8 flagged

package.jsonView file

Lines 62-93json

62 "events": "^3.3.0",

63 "memfs": "^4.68.1",

64 "path-browserify": "^1.0.1",

65 "stream-browserify": "^3.0.0",

66 "tsx": "^4.21.0",

67 "util": "^0.12.5"

68 },

69 "scripts": {

70 "build": "tsc --noEmit && tsup && npm run build:browser",

71 "dev": "export $(grep -v '^#' .env.test | xargs) && (tsc --noEmit --watch --preserveWatchOutput & tsup --watch)",

72 "cli": "export $(grep -v '^#' .env.test | xargs) && node dist/cli.js",

73 "lint": "biome lint",

74 "lint:fix": "biome lint --write",

75 "format": "biome format --write",

76 "format:check": "biome format",

77 "test": "vitest run",

78 "test:watch": "vitest",

79 "test:integration": "vitest run test/cli.test.ts",

80 "publint": "publint",

81 "updatedocs": "tsx scripts/update-docs.ts",

82 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "generate:registry": "tsx scripts/generate-registry.ts",

84 "build:binary": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && tsx scripts/build-binaries.ts",

85 "build:binary:current": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && bun build src/cli-binary.ts --compile --outfile=bin/tigris",

86 "dev:binary": "npm run generate:registry && tsc --noEmit --watch --preserveWatchOutput -p tsconfig.binary.json & bun build src/cli-binary.ts --compile --watch --outfile=bin/tigris",

87 "clean": "rm -rf dist",

88 "check": "biome check",

89 "check:fix": "biome check --write",

90 "generate:registry:browser": "tsx scripts/generate-registry.ts --target=browser",

91 "build:browser": "npm run generate:registry:browser && tsc --noEmit -p tsconfig.browser.json && tsx scripts/build-browser.ts && tsup --config tsup.browser.config.ts"

92 }

93}

dist/chunk-YXNJDI2L.jsView file

Lines 1-2javascript

1import{e as l}from"./chunk-ARZLX6CN.js";import{a as m,l as s}from"./chunk-VXGFGLXP.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-ZJWJRAFY.js"

dist/browser/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/browser/index.js: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... `+t);Yy.printJson=Ate});var Y3=z(wp=>{"use strict";f();d();l();Object.defineProperty(wp,"__esModule",{value:!0});var kv=(_i(),Mn(io));kv.__exportStar(V3(),wp);kv.__exportStar(J3(),... `;case"\\r":return"\r";case"\\t":return" ";case'\\"':return'"';case"\\/":return"/";case"\\\\":return"\\"}return t},BB=(t,e)=>t[e]===100&&t[e+1]===97&&t[e+2]===116&&t[e+3]===97&&t[e... `),CL()||r("")})},close(){},on(){return t}};return t}var TL=U(()=>{"

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/browser/index.jsView on unpkg

postinstall.cjsView file

Lines 1-21javascript

1const { openSync, writeSync, closeSync, mkdirSync, copyFileSync, existsSync } = require('fs');

2const { join } = require(

dist/chunk-7UKHARLH.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/chunk-7UKHARLH.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-7UKHARLH.jsView on unpkg

dist/lib/update.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/lib/update.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/update.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-YXNJDI2L.jsView file

1import{e as l}from"./chunk-ARZLX6CN.js";import{a as m,l as s}from"./chunk-VXGFGLXP.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-ZJWJRAFY.js";import{exists...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-YXNJDI2L.jsView on unpkg · L1

Findings

1 Critical5 High6 Medium4 Low

CriticalAi Agent Control Hijackpostinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/browser/index.js

HighKnown Malware Source Similaritydist/chunk-7UKHARLH.js

HighKnown Malware Source Similaritydist/lib/update.js

HighKnown Malware Source Similaritypostinstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-YXNJDI2L.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @tigrisdata/cli@3.12.1.

See all versions of @tigrisdata/cli for other recorded verdicts.

Review the evidence and your use of @tigrisdata/cli@3.12.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-10 03:29:35.450Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code