registry / @varveai/adit-cli / 1.0.6
@varveai/adit-cli@1.0.6
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged process execution and agent configuration are tied to explicit update or cloud-agent commands. The status-line payload contains session metadata and is posted to a loopback hook server; the reviewed source does not show unrelated credential exfiltration or concealed automatic behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running `adit cloud claude` starts the cloud-connected local Claude session; self-update runs only when its command is invoked.
Impact
The reviewed behavior exposes session metadata within the intended cloud-connected workflow; no unrelated credential collection or automatic install-time action was identified.
Mechanism
The command writes project-level Claude hook settings and sends status-line metadata to its local hook server for the cloud integration.
AI rationale
The flagged process execution and agent configuration are tied to explicit update or cloud-agent commands. The status-line payload contains session metadata and is posted to a loopback hook server; the reviewed source does not show unrelated credential exfiltration or concealed automatic behavior.
Evidence
<project>/.claude/settings.local.json<project>/.claude/adit-cloud-<terminalId>.settings.local.json
Network endpoints1
127.0.0.1 /hook
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The Claude cloud integration is an explicit `adit cloud claude` command that connects a local Claude CLI to adit-cloud.
- The command requires existing cloud credentials and uses the configured, credential-associated, or default cloud server URL.
- The generated status-line hook posts model, effort, session, transcript-path, and working-directory metadata to a hook server bound to 127.0.0.1.
- Claude hook configuration is written under the project’s `.claude` directory when the cloud command starts; persistent hook repair is limited to projects already recorded as connected to Claude Code.
- Self-update subprocesses are confined to the explicit update command; the package declares build and typecheck scripts but no lifecycle scripts.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
4 flaggeddist/commands/self-update.jsView file
8*/
L9: import { execSync } from "node:child_process";
L10: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
dist/commands/self-update.jsView on unpkg · L8124console.log("Installing dependencies ...");
L125: execSync("pnpm install --frozen-lockfile", {
L126: ...showExecOpts,
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/commands/self-update.jsView on unpkg · L124dist/commands/cli-agent/cli-process.jsView file
80* Terminate a spawned CLI, including its descendants on Windows. `.cmd`/`.bat`
L81: * shims run under a cmd.exe shell, so killing only the direct child leaves the
L82: * real CLI (e.g. claude.exe) alive and still reading the console — which is
Findings
1 Critical3 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/commands/cli-agent/claude/hooks-bootstrap.js
HighChild Processdist/commands/self-update.js
HighShelldist/commands/cli-agent/cli-process.js
HighRuntime Package Installdist/commands/self-update.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @varveai/adit-cli@1.0.6.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.