registry / @varveai/adit-cli / 1.1.1
@varveai/adit-cli@1.1.1
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall performs automatic setup in user-level agent skill directories and starts a local service for published installs. The behavior is limited to the package's own tooling, so it is a lifecycle risk rather than clear malicious activity.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm package installation outside CI and a root account.
Impact
Agent-discovered skill directories are modified without an explicit setup command, and a local background service is started during installation.
Mechanism
The lifecycle hook invokes the package installer, which writes ADIT skill files into the user's Claude and Agents skill directories; the published-package path also starts the daemon and opens its local URL.
AI rationale
The postinstall performs automatic setup in user-level agent skill directories and starts a local service for published installs. The behavior is limited to the package's own tooling, so it is a lifecycle risk rather than clear malicious activity.
Evidence
package.jsoninstall-skill.cjsdist/installation.jsdist/commands/skills.js~/.agents/skills/<skill-name>/SKILL.md~/.agents/skills/<skill-name>/.adit-managed.json~/.claude/skills/<skill-name>/SKILL.md~/.claude/skills/<skill-name>/.adit-managed.json
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json runs install-skill.cjs as a postinstall hook.
- The published-package postinstall path invokes install-skills.js with --open-browser; the workspace path uses --skills-only.
- The installer writes ADIT skill files under the user's ~/.agents/skills and ~/.claude/skills directories.
- The published-package setup installs skills, starts a local background service, and can open its page.
Evidence against
- The installed files are the package's own ADIT skills, consistent with its AI development tooling purpose.
- The skill installer preserves customized copies and skips symbolic links.
- The postinstall skips setup in CI and refuses to run as root.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/local/attribution-analysis.jsView file
1import { createHash, randomUUID } from "node:crypto";
L2: import { execFile } from "node:child_process";
L3: import { promisify } from "node:util";
High
Child Process
Package source references child process execution.
dist/local/attribution-analysis.jsView on unpkg · L1dist/commands/cli-agent/cli-process.jsView file
80
Findings
1 Critical7 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/main.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/local/attribution-analysis.js
HighShelldist/commands/cli-agent/cli-process.js
HighCommand Output Exfiltrationdist/commands/pr.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/pr.js
HighRuntime Package Installdist/commands/self-update.js
HighSemantic Analysis Limiteddist/local/attribution-evidence.js#virtual:normalized:round1
MediumDynamic Requiredist/version.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @varveai/adit-cli@1.1.1.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.