@varveai/adit-cli@1.0.12
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically sends its version to the vendor’s policy endpoint for selected commands, and the documented update-check opt-out does not suppress that request. The narrow data and policy-check purpose make this warning-level telemetry rather than malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running one of the commands wrapped by the update-policy check, including init, status, doctor, or cloud commands.
Impact
The vendor learns the installed CLI version and can block selected commands according to its version policy.
Mechanism
The wrapper queries the policy endpoint with the current version before it checks ADIT_NO_UPDATE_CHECK. The response can block the wrapped command.
AI rationale
The package automatically sends its version to the vendor’s policy endpoint for selected commands, and the documented update-check opt-out does not suppress that request. The narrow data and policy-check purpose make this warning-level telemetry rather than malicious behavior.
Evidence
dist/update-check.js~/.adit/version-check.json
Network endpoints2
adit-cloud.varve.ai/api/client-version-policyregistry.npmjs.org/@varveai%2fadit-cli/latest
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Selected CLI commands automatically query the version-policy service before running their handlers.
- The policy request sends the installed version in the query string and in the user-agent; its default endpoint is the vendor’s adit-cloud service.
- ADIT_NO_UPDATE_CHECK is evaluated after the policy request, so it does not disable that request.
Evidence against
- The version check sends version information only; the inspected request does not include credentials, project data, or session content.
- The cloud Claude relay and its hook setup require an explicit cloud command and existing login credentials.
- The hook server binds to 127.0.0.1, and the manifest declares no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/commands/self-update.jsView file
8*/
L9: import { execSync } from "node:child_process";
L10: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/commands/self-update.jsView on unpkg · L8124console.log("Installing dependencies ...");
L125: execSync("pnpm install --frozen-lockfile", {
L126: ...showExecOpts,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/commands/self-update.jsView on unpkg · L124dist/commands/cli-agent/cli-process.jsView file
80* Terminate a spawned CLI, including its descendants on Windows. `.cmd`/`.bat`
L81: * shims run under a cmd.exe shell, so killing only the direct child leaves the
L82: * real CLI (e.g. claude.exe) alive and still reading the console — which is
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/cli-agent/claude/hooks-bootstrap.js
HighChild Processdist/commands/self-update.js
HighShelldist/commands/cli-agent/cli-process.js
HighRuntime Package Installdist/commands/self-update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @varveai/adit-cli@1.0.12.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.0.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.