registry / @varveai/adit-cli / 1.1.4
@varveai/adit-cli@1.1.4
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook performs user-level AI-agent skill setup and starts the package's local service automatically. The skills are package-specific and the source shows no concrete attack, so this is a warning-level agent extension lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation through the postinstall hook, except in CI or when running as root.
Impact
Agent sessions may pick up ADIT skills without a separate user command, and installation starts a local background service.
Mechanism
The hook runs dist/install-skills.js, which installs skills under the user's home directory and proceeds to start or restart the daemon for published installs.
AI rationale
The postinstall hook performs user-level AI-agent skill setup and starts the package's local service automatically. The skills are package-specific and the source shows no concrete attack, so this is a warning-level agent extension lifecycle risk.
Evidence
package.jsoninstall-skill.cjsdist/installation.jsdist/commands/skills.js~/.agents/skills~/.claude/skills
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs install-skill.cjs from its postinstall hook.
- For published installs, the hook invokes the installer with --open-browser unless CI or root checks prevent setup.
- The installer installs ADIT skills into the user's ~/.agents/skills and ~/.claude/skills directories.
- The published-install setup also starts or restarts the local ADIT background service.
Evidence against
- The skills are the package's own ADIT skills, and the installer documents that it does not overwrite customized copies.
- The installer skips setup in CI and rejects running as root.
- The flagged PR command's repository lookup and local daemon requests occur only when the user invokes the PR command.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/local/attribution-analysis.jsView file
1import { createHash, randomUUID } from "node:crypto";
L2: import { execFile } from "node:child_process";
L3: import { promisify } from "node:util";
High
Child Process
Package source references child process execution.
dist/local/attribution-analysis.jsView on unpkg · L1dist/commands/cli-agent/cli-process.jsView file
80
Findings
1 Critical7 High4 Medium5 Low
CriticalAi Agent Control Hijackdist/main.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/local/attribution-analysis.js
HighShelldist/commands/cli-agent/cli-process.js
HighCommand Output Exfiltrationdist/commands/pr.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/pr.js
HighRuntime Package Installdist/commands/self-update.js
HighSemantic Analysis Limiteddist/local/attribution-evidence.js#virtual:normalized:round1
MediumDynamic Requiredist/version.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @varveai/adit-cli@1.1.4.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.