registry  /  @txpipe/dolos  /  1.4.0

@txpipe/dolos@1.4.0

A Cardano data-node built in Rust

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a native CLI wrapper that downloads an expected platform-specific Dolos release artifact during npm postinstall and runs it when the dolos bin is invoked.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user invoking dolos runs the installed native binary
Impact
Installs Dolos binary under the package directory; no source evidence of exfiltration or unauthorized control-surface mutation
Mechanism
package-aligned native binary downloader and CLI wrapper
Rationale
The suspicious primitives are explained by a standard native binary npm wrapper for the declared Dolos CLI and are limited to package-aligned GitHub release downloads and local extraction. Static inspection found no concrete malicious behavior, credential access, exfiltration, persistence, or agent control-surface mutation.
Evidence
package.jsoninstall.jsbinary.jsbinary-install.jsrun-dolos.jsREADME.mdnode_modules/.bin_realOS temp directory artifact download
Network endpoints1
github.com/txpipe/dolos/releases/download/v1.4.0

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
  • package.json defines postinstall node ./install.js
  • binary-install.js downloads a platform tarball and extracts it into node_modules/.bin_real
  • binary-install.js uses child_process.spawnSync for tar/unzip/powershell extraction and to run the installed CLI binary
Evidence against
  • Download URL is package-aligned: https://github.com/txpipe/dolos/releases/download/v1.4.0
  • run-dolos.js only invokes the dolos binary with user CLI args
  • No credential/env harvesting, data exfiltration, persistence, destructive project mutation, eval/vm, or AI-agent control-surface writes found
  • README describes @txpipe/dolos as a native multi-platform Cardano data-node CLI package
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 4 file(s), 10.0 KB of source, external domains: example.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings