@tigrisdata/cli@3.17.0

Command line interface for Tigris object storage

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The postinstall hook silently installs a package-owned skill into an existing Claude Code configuration, which qualifies as agent extension lifecycle risk. The inspected source does not establish the scanner’s unrelated credential-forwarding claim.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The package is installed as a dependency and a Claude configuration directory and bundled skill file exist.

Impact

Claude Code gains package-provided Tigris instructions without a separate setup action; no broader agent configuration change was established.

Mechanism

The postinstall hook creates the Tigris skill directory and copies the package-owned skill into it.

AI rationale

Evidence

package.jsonpostinstall.cjsSKILL.md~/.claude/skills/tigris/SKILL.md

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs postinstall.cjs during installation.
The hook copies the bundled skill only when a Claude directory and the skill source exist.
The destination is the Tigris skill directory under Claude’s home configuration.
The skill describes Tigris object-storage CLI use, consistent with the package’s purpose.
Browser login uses a saved endpoint or the Tigris service default; the inspected code does not establish forwarding to an unrelated fixed gateway.

Evidence against

The postinstall hook does not make broad agent configuration changes; its observed write is limited to the package-owned skill file.
The inspected browser login path selects a saved endpoint or the Tigris default.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

8 flagged

package.jsonView file

Lines 62-93json

62 "events": "^3.3.0",

63 "memfs": "^4.68.1",

64 "path-browserify": "^1.0.1",

65 "stream-browserify": "^3.0.0",

66 "tsx": "^4.21.0",

67 "util": "^0.12.5"

68 },

69 "scripts": {

70 "build": "tsc --noEmit && tsup && npm run build:browser",

71 "dev": "export $(grep -v '^#' .env.test | xargs) && (tsc --noEmit --watch --preserveWatchOutput & tsup --watch)",

72 "cli": "export $(grep -v '^#' .env.test | xargs) && node dist/cli.js",

73 "lint": "biome lint",

74 "lint:fix": "biome lint --write",

75 "format": "biome format --write",

76 "format:check": "biome format",

77 "test": "vitest run",

78 "test:watch": "vitest",

79 "test:integration": "vitest run test/cli.test.ts",

80 "publint": "publint",

81 "updatedocs": "tsx scripts/update-docs.ts",

82 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 "generate:registry": "tsx scripts/generate-registry.ts",

84 "build:binary": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && tsx scripts/build-binaries.ts",

85 "build:binary:current": "npm run generate:registry && tsc --noEmit -p tsconfig.binary.json && bun build src/cli-binary.ts --compile --outfile=bin/tigris",

86 "dev:binary": "npm run generate:registry && tsc --noEmit --watch --preserveWatchOutput -p tsconfig.binary.json & bun build src/cli-binary.ts --compile --watch --outfile=bin/tigris",

87 "clean": "rm -rf dist",

88 "check": "biome check",

89 "check:fix": "biome check --write",

90 "generate:registry:browser": "tsx scripts/generate-registry.ts --target=browser",

91 "build:browser": "npm run generate:registry:browser && tsc --noEmit -p tsconfig.browser.json && tsx scripts/build-browser.ts && tsup --config tsup.browser.config.ts"

92 }

93}

dist/browser/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/browser/index.js: `+" ".repeat(t.indentationLvl)):"["+Error.prototype.toString.call(e)+"]",s.length===0)return a}else if((0,xe.hasBrand)(xe.arrayBufferByteLength,e)||xe.sharedArrayBufferByteLength!=... `),"ERR_INTERNAL_ASSERTION"),mne=(t,e)=>{if(Array.isArray(t)){for(let r=0;r<t.length;r++)if(typeof t[r]!="string")throw(0,Hb.invalidArgType)(e+"["+r+"]","of type string",t[r]);retu... `+t);g0.printJson=vse});var Pj=z(hm=>{"use strict";f();d();u();Object.defineProperty(hm,"__esModule",{value:!0});var gC=(qi(),fi(Oo));gC.__exportStar(Rj(),hm);gC.__exportStar(Ij(),... `;case"\\r":return"\r";case"\\t":return" ";case'\\"':return'"';case"

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/browser/index.jsView on unpkg

143`+" ".repeat(t.indentationLvl);return c+l+" "+nL(e,","+l+" ")+l+n[1]};qn.reduceToSingleString=iee});var aL=z(Se=>{"use strict";f();d();u();Object.defineProperty(Se,"__esModule",{... L144: `+" ".repeat(t.indentationLvl)):"["+Error.prototype.toString.call(e)+"]",s.length===0)return a}else if((0,xe.hasBrand)(xe.arrayBufferByteLength,e)||xe.sharedArrayBufferByteLength!=... L145: Please open an issue with this stack trace at https://github.com/nodejs/node/issues

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/browser/index.jsView on unpkg · L143

dist/chunk-GE2NFNN4.jsView file

Lines 1-2javascript

1import{e as l}from"./chunk-CBS7RVDP.js";import{a as m,i as s}from"./chunk-LBTT65MM.js";import{b as i}from"./chunk-NI4EYBQH.js";import{a as t}from"./chunk-AQZXG57U.js"

postinstall.cjsView file

Lines 1-21javascript

1const { openSync, writeSync, closeSync, mkdirSync, copyFileSync, existsSync } = require('fs');

2const { join } = require(

dist/chunk-7UKHARLH.jsView file

•matchType = normalized_sha256 matchedPackage = @tigrisdata/cli@3.11.0 matchedPath = dist/chunk-7UKHARLH.js matchedIdentity = npm:QHRpZ3Jpc2RhdGEvY2xp:3.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-7UKHARLH.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/browser/index.jsView file

Findings

1 Critical4 High5 Medium5 Low

CriticalAi Agent Control Hijackpostinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/browser/index.js

HighKnown Malware Source Similaritydist/chunk-7UKHARLH.js

HighKnown Malware Source Similaritypostinstall.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/chunk-GE2NFNN4.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/browser/index.js

LowFilesystem

Low

Affected versions and remediation

This report applies to @tigrisdata/cli@3.17.0.

See all versions of @tigrisdata/cli for other recorded verdicts.

Review the evidence and your use of @tigrisdata/cli@3.17.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 07:34:36.621Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code