@tonik/quickshot@0.10.0
CLI for managing Tonik Quickshot optional features
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe default registry client automatically attaches a locally available GitHub token to requests sent to the vendor's fixed registry host. Sending a user's credential to the package vendor without consent is credential exfiltration under the review rules.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A CLI operation that requests the default registry, such as fetching its manifest.
Impact
The vendor-controlled registry receives the user's GitHub credential without an explicit request to share it with that service.
Mechanism
The registry client resolves a GitHub token from environment variables or saved auth, then attaches it as a Bearer token to requests at the fixed registry host.
Attack narrative
When a CLI operation fetches data from the default registry, the package resolves a GitHub token from GH_TOKEN, GITHUB_TOKEN, or its saved auth store and sends it as a Bearer token to tonik-quickshot-registry.vercel.app. This exposes the user's GitHub credential to the package vendor without explicit consent.
AI rationale
The default registry client automatically attaches a locally available GitHub token to requests sent to the vendor's fixed registry host. Sending a user's credential to the package vendor without consent is credential exfiltration under the review rules.
Evidence
dist/index.jspackage.json
Network endpoints1
tonik-quickshot-registry.vercel.app
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest describes a CLI for managing Tonik Quickshot features.
- The token resolver reads GH_TOKEN or GITHUB_TOKEN and can fall back to a stored GitHub token.
- The default registry client targets tonik-quickshot-registry.vercel.app and receives the GitHub token resolver.
- Registry requests add the resolved token as a Bearer authorization header.
- The registry client fetches its manifest through that authenticated request path.
Evidence against
- The manifest has no install lifecycle scripts; the behavior is triggered when the CLI makes a registry request.
- The package also makes provider API requests for its stated project setup purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
77init_esm_shims();
L78: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ...
L79: };
...
L2673: init_esm_shims();
L2674: import { execFileSync } from "child_process";
L2675: function getGitWorktreeState(cwd) {
L2676: try {
L2677: const stdout = runGitCommand(cwd, ["status", "--porcelain"]);
L2678: return stdout === "" ? "clean" : "dirty";
...
L2770: var DEFAULT_REGISTRY_NAME = "tonik";
L2771: var DEFAULT_REGISTRY_URL = "https://tonik-quickshot-registry.vercel.app";
L2772: var DEFAULT_CONFIG_DIR_PATH = ".quickshot";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L7777Trigger-reachable chain: scripts.dev -> dist/index.js
L77: init_esm_shims();
L78: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ...
L79: };
...
L2673: init_esm_shims();
L2674: import { execFileSync } from "child_process";
L2675: function getGitWorktreeState(cwd) {
L2676: try {
L2677: const stdout = runGitCommand(cwd, ["status", "--porcelain"]);
L2678: return stdout === "" ? "clean" : "dirty";
...
L2770: var DEFAULT_REGISTRY_NAME = "tonik";
L2771: var DEFAULT_REGISTRY_URL = "https://tonik-quickshot-registry.vercel.app";
L2772: var DEFAULT_CONFIG_DIR_PATH = ".quickshot";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tonik/quickshot@0.10.0.
See all versions of @tonik/quickshot for other recorded verdicts.
- Avoid installing @tonik/quickshot@0.10.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.