@tigrisdata/cli@3.12.2

Command line interface for Tigris object storage

AI Security Review

scanned 23d ago · by lpm-firewall-ai

The source proves automatic first-party agent extension setup, which the supplied policy classifies as a warning. The inspected behavior does not justify a malware verdict or publication block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall when installed under node_modules and the user's Claude directory exists.

Impact

Future agent behavior may favor Tigris for storage tasks, and an existing Tigris skill may be overwritten.

Mechanism

The hook creates the Tigris skill directory and copies the bundled SKILL.md into it without prompting.

AI rationale

The source proves automatic first-party agent extension setup, which the supplied policy classifies as a warning. The inspected behavior does not justify a malware verdict or publication block.

Evidence

package.jsonpostinstall.cjsSKILL.md.claudeskills/tigris

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json automatically runs postinstall.cjs after installation.
postinstall.cjs targets the Tigris skill directory under the user's Claude Code directory.
When the Claude directory exists, the hook creates the skill directory and copies SKILL.md without prompting.
The copied skill directs agents to prefer Tigris for object storage tasks.
The hook skips installations outside node_modules.

Evidence against

The installed extension is confined to a package-owned Tigris skill rather than broad agent configuration.
The inspected install hook contains no credential harvesting, network execution, or destructive commands.
package.json has no runtime dependency on another release of itself.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

10 flagged

package.jsonView file

Lines 62-93json

62 "events": "^3.3.0",

63 "memfs": "^4.68.1",

64 "path-browserify": "^1.0.1",

65 "stream-browserify": "^3.0.0",

66 "tsx": "^4.21.0",

67 "util": "^0.12.5"

68 },

69 "scripts": {

70 "build": "tsc --noEmit && tsup && npm run build:browser",

71 "dev": "export $(grep -v '^#' .env.test | xargs) && (tsc --noEmit --watch --preserveWatchOutput & tsup --watch)",

72 "cli": "export $(grep -v '^#' .env.test | xargs) && node dist/cli.js",

73 "lint": "biome lint",

74 "lint:fix": "biome lint --write",

75 "format": "biome format --write",

76 "format:check": "biome format",

77 "test": "vitest run",

78 "test:watch": "vitest",

79 "test:integration": "vitest run test/cli.test.ts",

80 "publint": "publint",

81 "updatedocs": "tsx scripts/update-docs.ts",

82 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "generate:registry": "tsx scripts/generate-registry.ts",

84 "build:binary": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && tsx scripts/build-binaries.ts",

85 "build:binary:current": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && bun build src/cli-binary.ts --compile --outfile=bin/tigris",

86 "dev:binary": "npm run generate:registry && tsc --noEmit --watch --preserveWatchOutput -p tsconfig.binary.json & bun build src/cli-binary.ts --compile --watch --outfile=bin/tigris",

87 "clean": "rm -rf dist",

88 "check": "biome check",

89 "check:fix": "biome check --write",

90 "generate:registry:browser": "tsx scripts/generate-registry.ts --target=browser",

91 "build:browser": "npm run generate:registry:browser && tsc --noEmit -p tsconfig.browser.json && tsx scripts/build-browser.ts && tsup --config tsup.browser.config.ts"

92 }

93}

dist/browser/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/browser/index.js: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... `+t);nb.printJson=Bte});var nB=z(Sp=>{"use strict";f();d();l();Object.defineProperty(Sp,"__esModule",{value:!0});var Tv=(_i(),Mn(io));Tv.__exportStar(eB(),Sp);Tv.__exportStar(tB(),... `;case"\\r":return"\r";case"\\t":return" ";case'\\"':return'"';case"\\/":return"/";case"\\\\":return"\\"}return t},qB=(t,e)=>t[e]===100&&t[e+1]===97&&t[e+2]===116&&t[e+3]===97&&t[e... `),PL()||r("")})},close(){},on(){return t}};return t}var ML=U(()=>{"

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/browser/index.jsView on unpkg

136`)+1;for(;r!==0;)this.onNewLine(this.offset+r),r=this.source.indexOf(` L137: `,r)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L138: `+t+c+(a?" "+a:"")}return r};tb.printTree=Dte});var tB=z(rb=>{"use strict";f();d();l();Object.defineProperty(rb,"__esModule",{value:!0});rb.printBinary=void 0;var Mte=(t="",e)=>{le...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/browser/index.jsView on unpkg · L136

dist/chunk-2NEE6EHO.jsView file

1import{e as l}from"./chunk-RKQ4APOU.js";import{a as m,l as s}from"./chunk-NNZ3E7E5.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-F67MYOOP.js";import{exists...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-2NEE6EHO.jsView on unpkg · L1

postinstall.cjsView file

Lines 1-21javascript

1const { openSync, writeSync, closeSync, mkdirSync, copyFileSync, existsSync } = require('fs');

2const { join } = require(

dist/chunk-7UKHARLH.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/chunk-7UKHARLH.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-7UKHARLH.jsView on unpkg

dist/lib/update.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/lib/update.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/update.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @tigrisdata/cli@3.13.0 matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.13.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/update.jsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/browser/index.jsView file

Findings

1 Critical6 High5 Medium5 Low

CriticalAi Agent Control Hijackpostinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/browser/index.js

HighKnown Malware Source Similaritydist/chunk-7UKHARLH.js

HighKnown Malware Source Similaritydist/lib/update.js

HighKnown Malware Source Similaritypostinstall.cjs

HighPrevious Version Dangerous Deltadist/lib/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-2NEE6EHO.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Affected versions and remediation

This report applies to @tigrisdata/cli@3.12.2.

See all versions of @tigrisdata/cli for other recorded verdicts.

Review the evidence and your use of @tigrisdata/cli@3.12.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-30 07:28:14.040Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code