registry / @treramey/drag / 0.3.0

@treramey/drag@0.3.0

A fast Tempo.io Cloud command-line client

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install-time code retrieves and unpacks a remote native binary into the package directory. The installed CLI later executes that binary.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall, or invoking `drag` when its binary is absent.

Impact

A compromised or replaced GitHub release asset can place executable code in the installed package and run when the CLI is used.

Mechanism

remote binary download, same-origin checksum check, extraction, and execution

Rationale

No direct exfiltration, destructive action, stealth persistence, or AI-agent control-surface mutation is present in the reviewed JavaScript. However, install-time retrieval and later execution of an externally hosted native payload creates a concrete unresolved supply-chain risk.

Evidence

package.jsoninstall.jsplatform.jsrun.jsbin

Network endpoints1

github.com/treramey/drag/releases/download/v${version}/${platform.artifact}

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

@treramey/drag@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code