registry / @unwita-insights/vaxis / 0.2.3

@unwita-insights/vaxis@0.2.3

Vaxis CLI — diagram and architecture tool for AI-assisted software design

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time code fetches an unverified native executable, which the CLI later executes. No confirmed credential theft, agent-control mutation, or destructive behavior appears in the shipped JavaScript.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs `postinstall`; later, a user invokes `vaxis`.

Impact

A compromised release asset or redirect target could supply arbitrary native code to an installing user.

Mechanism

remote native-binary download followed by local execution

Rationale

The package creates a real unverified remote-native-binary execution path at install/runtime, so it warrants a warning. Source inspection found no concrete malicious actions beyond that supply-chain risk.

Evidence

package.jsonscripts/postinstall.jsbin/vaxis.jsbin/vaxis-nativebin/vaxis-native.exe

Network endpoints1

github.com/Unwita-Insights/vaxis-cli/releases/download/v0.2.3/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

@unwita-insights/vaxis@0.2.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code