@tonik/quickshot@0.9.0
CLI for managing Tonik Quickshot optional features
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI automatically forwards discovered GitHub credentials to its vendor-operated registry during registry requests. This is credential exfiltration under the package firewall rules, even though the request is initiated by a user-run CLI command.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs a command such as `list` that fetches the default registry manifest, while a GitHub token is available.
Impact
The registry operator receives a GitHub credential that may grant access to the user's repositories.
Mechanism
The CLI resolves a token from GH_TOKEN, GITHUB_TOKEN, its auth store, or `gh auth token`, then sends it in an Authorization Bearer header to the default registry.
Attack narrative
When a registry command fetches the default registry, the CLI silently looks for a GitHub token in environment variables, its saved auth store, or the GitHub CLI, then sends that token as a Bearer credential to tonik-quickshot-registry.vercel.app. This exposes a credential for GitHub to the package vendor without explicit consent.
AI rationale
The CLI automatically forwards discovered GitHub credentials to its vendor-operated registry during registry requests. This is credential exfiltration under the package firewall rules, even though the request is initiated by a user-run CLI command.
Evidence
dist/index.js
Network endpoints1
tonik-quickshot-registry.vercel.app
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The token resolver retrieves GH_TOKEN or GITHUB_TOKEN from the environment.
- The default registry client is configured to call resolveGithubToken for authentication.
- Registry requests attach the resolved token as a Bearer authorization header.
- The list command fetches a registry manifest, triggering this credential flow when a GitHub token is available.
- The default registry is hosted at tonik-quickshot-registry.vercel.app.
Evidence against
- The package is presented as a CLI for managing Tonik Quickshot features.
- The credential is sent during registry requests initiated by CLI commands, rather than an install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/index.jsView file
77init_esm_shims();
L78: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ...
L79: };
...
L2670: init_esm_shims();
L2671: import { execFileSync } from "child_process";
L2672: function getGitWorktreeState(cwd) {
L2673: try {
L2674: const stdout = runGitCommand(cwd, ["status", "--porcelain"]);
L2675: return stdout === "" ? "clean" : "dirty";
...
L2767: var DEFAULT_REGISTRY_NAME = "tonik";
L2768: var DEFAULT_REGISTRY_URL = "https://tonik-quickshot-registry.vercel.app";
L2769: var DEFAULT_CONFIG_DIR_PATH = ".quickshot";
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.jsView on unpkg · L7777Trigger-reachable chain: scripts.dev -> dist/index.js
L77: init_esm_shims();
L78: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ...
L79: };
...
L2670: init_esm_shims();
L2671: import { execFileSync } from "child_process";
L2672: function getGitWorktreeState(cwd) {
L2673: try {
L2674: const stdout = runGitCommand(cwd, ["status", "--porcelain"]);
L2675: return stdout === "" ? "clean" : "dirty";
...
L2767: var DEFAULT_REGISTRY_NAME = "tonik";
L2768: var DEFAULT_REGISTRY_URL = "https://tonik-quickshot-registry.vercel.app";
L2769: var DEFAULT_CONFIG_DIR_PATH = ".quickshot";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical3 High3 Medium4 Low
CriticalCredential Exfiltrationdist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighCredential Redirect Persistencedist/index.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
HighAi Review Evidencedist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @tonik/quickshot@0.9.0.
See all versions of @tonik/quickshot for other recorded verdicts.
- Avoid installing @tonik/quickshot@0.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.