@tigrisdata/cli@3.13.0

Command line interface for Tigris object storage

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package performs an automatic, first-party global AI-agent skill installation. This is a guarded extension lifecycle risk rather than confirmed malware.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm post-install execution during dependency installation.

Impact

This changes an AI-agent instruction surface without an explicit setup command, causing future Claude sessions to receive Tigris preferences.

Mechanism

The lifecycle script creates a Tigris skill directory under the user's Claude configuration and copies the packaged skill into it.

AI rationale

The package performs an automatic, first-party global AI-agent skill installation. This is a guarded extension lifecycle risk rather than confirmed malware.

Evidence

package.jsonpostinstall.cjsSKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package manifest runs a post-install script automatically.
That script runs for dependency installs and targets the existing Claude configuration directory.
It creates a global Tigris skill directory and copies its skill file there.
The installed skill directs agents to prefer Tigris for object-storage work.

Evidence against

The write is limited to a Tigris-named Claude skill and occurs only when an existing Claude directory is present.
No credential export, destructive action, or unrelated network recipient was identified in the inspected lifecycle code.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

9 flagged

package.jsonView file

Lines 62-93json

62 "events": "^3.3.0",

63 "memfs": "^4.68.1",

64 "path-browserify": "^1.0.1",

65 "stream-browserify": "^3.0.0",

66 "tsx": "^4.21.0",

67 "util": "^0.12.5"

68 },

69 "scripts": {

70 "build": "tsc --noEmit && tsup && npm run build:browser",

71 "dev": "export $(grep -v '^#' .env.test | xargs) && (tsc --noEmit --watch --preserveWatchOutput & tsup --watch)",

72 "cli": "export $(grep -v '^#' .env.test | xargs) && node dist/cli.js",

73 "lint": "biome lint",

74 "lint:fix": "biome lint --write",

75 "format": "biome format --write",

76 "format:check": "biome format",

77 "test": "vitest run",

78 "test:watch": "vitest",

79 "test:integration": "vitest run test/cli.test.ts",

80 "publint": "publint",

81 "updatedocs": "tsx scripts/update-docs.ts",

82 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "generate:registry": "tsx scripts/generate-registry.ts",

84 "build:binary": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && tsx scripts/build-binaries.ts",

85 "build:binary:current": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && bun build src/cli-binary.ts --compile --outfile=bin/tigris",

86 "dev:binary": "npm run generate:registry && tsc --noEmit --watch --preserveWatchOutput -p tsconfig.binary.json & bun build src/cli-binary.ts --compile --watch --outfile=bin/tigris",

87 "clean": "rm -rf dist",

88 "check": "biome check",

89 "check:fix": "biome check --write",

90 "generate:registry:browser": "tsx scripts/generate-registry.ts --target=browser",

91 "build:browser": "npm run generate:registry:browser && tsc --noEmit -p tsconfig.browser.json && tsx scripts/build-browser.ts && tsup --config tsup.browser.config.ts"

92 }

93}

dist/browser/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/browser/index.js: `+" ".repeat(t.indentationLvl)):"["+Error.prototype.toString.call(e)+"]",s.length===0)return a}else if((0,Se.hasBrand)(Se.arrayBufferByteLength,e)||Se.sharedArrayBufferByteLength!=... `),"ERR_INTERNAL_ASSERTION"),jre=(t,e)=>{if(Array.isArray(t)){for(let r=0;r<t.length;r++)if(typeof t[r]!="string")throw(0,Nb.invalidArgType)(e+"["+r+"]","of type string",t[r]);retu... `+t);o0.printJson=Joe});var hj=z(im=>{"use strict";f();d();u();Object.defineProperty(im,"__esModule",{value:!0});var oC=(Ui(),ai(Co));oC.__exportStar(dj(),im);oC.__exportStar(pj(),... `;case"\\r":return"\r";case"\\t":return" ";case'\\"':return'"';case"

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/browser/index.jsView on unpkg

143`+" ".repeat(t.indentationLvl);return c+l+" "+$B(e,","+l+" ")+l+n[1]};Fn.reduceToSingleString=OZ});var HB=z(we=>{"use strict";f();d();u();Object.defineProperty(we,"__esModule",{v... L144: `+" ".repeat(t.indentationLvl)):"["+Error.prototype.toString.call(e)+"]",s.length===0)return a}else if((0,Se.hasBrand)(Se.arrayBufferByteLength,e)||Se.sharedArrayBufferByteLength!=... L145: Please open an issue with this stack trace at https://github.com/nodejs/node/issues

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/browser/index.jsView on unpkg · L143

dist/chunk-Y4FIJDZ4.jsView file

Lines 1-2javascript

1import{e as l}from"./chunk-VSUYES3O.js";import{a as m,h as s}from"./chunk-QCASVW5M.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-RZMWZYTK.js"

postinstall.cjsView file

Lines 1-21javascript

1const { openSync, writeSync, closeSync, mkdirSync, copyFileSync, existsSync } = require('fs');

2const { join } = require(

dist/chunk-7UKHARLH.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/chunk-7UKHARLH.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-7UKHARLH.jsView on unpkg

dist/lib/update.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tigrisdata/cli@3.12.1 matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.12.1 similarity = 0.408 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/update.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/browser/index.jsView file

Findings

1 Critical5 High5 Medium5 Low

CriticalAi Agent Control Hijackpostinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/browser/index.js

HighKnown Malware Source Similaritydist/chunk-7UKHARLH.js

HighKnown Malware Source Similaritypostinstall.cjs

HighPrevious Version Dangerous Deltadist/lib/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-Y4FIJDZ4.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/browser/index.js

Affected versions and remediation

This report applies to @tigrisdata/cli@3.13.0.

See all versions of @tigrisdata/cli for other recorded verdicts.

Review the evidence and your use of @tigrisdata/cli@3.13.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 02:34:25.179Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code