registry / @unwita-insights/vaxis / 0.2.4

@unwita-insights/vaxis@0.2.4

Vaxis CLI — diagram and architecture tool for AI-assisted software design

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The install hook fetches an unverified native payload from a release URL, then the CLI executes it on user invocation. No source evidence establishes malicious behavior inside the downloaded payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs `postinstall`; invoking `vaxis` runs the downloaded binary.

Impact

A compromised or substituted release artifact could execute with the installing user's privileges.

Mechanism

Unverified remote native-binary download and execution

Rationale

Source inspection found no credential theft, broad persistence, destructive action, or foreign control-surface mutation. However, the package installs and later executes an unverified remote native payload, so it warrants a warning rather than a clean verdict.

Evidence

package.jsonscripts/postinstall.jsbin/vaxis.jsbin/vaxis-native

Network endpoints1

github.com/Unwita-Insights/vaxis-cli/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

@unwita-insights/vaxis@0.2.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code