registry / @varveai/adit-cli / 1.1.7
@varveai/adit-cli@1.1.7
AI Development Intent Tracker — Transparent Time Machine for your codebase
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe postinstall hook automatically installs this package’s own skills into user-level Claude and agent skill directories and starts its local service, which can also enable login startup. The setup is limited to the package’s own functionality, so this is a warning-level agent extension lifecycle risk rather than evidence of malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Package installation outside CI and outside a root account.
Impact
Agent sessions may load newly installed skills, and the local service may start automatically at login without a separate setup command.
Mechanism
The lifecycle hook runs the bundled installer, which writes ADIT skills under the user’s home and starts the daemon; daemon startup initializes login registration if unset.
AI rationale
The postinstall hook automatically installs this package’s own skills into user-level Claude and agent skill directories and starts its local service, which can also enable login startup. The setup is limited to the package’s own functionality, so this is a warning-level agent extension lifecycle risk rather than evidence of malicious behavior.
Evidence
package.jsoninstall-skill.cjsdist/installation.jsdist/commands/skills.jsdist/local/server.jsdist/local/login-startup.js~/.agents/skills/<ADIT skill>/SKILL.md~/.claude/skills/<ADIT skill>/SKILL.mdplatform-specific user login startup registration
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs `node install-skill.cjs` from its postinstall hook.
- The published installer runs setup with `--open-browser`; setup installs skills and starts the local service.
- Setup writes ADIT skill files into the user’s `~/.agents/skills` and `~/.claude/skills` directories.
- Starting the service initializes login startup registration on supported platforms when no prior setting exists.
Evidence against
- The installed files are the package’s own ADIT skills, and existing customized copies are preserved.
- The daemon and login registration are for the package’s local service; no unrelated credential collection or external account action was identified.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node install-skill.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/local/auto-update-process.jsView file
1import { spawn } from "node:child_process";
L2: import { createHash, randomUUID } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/local/auto-update-process.jsView on unpkg · L1dist/commands/cli-agent/cli-process.jsView file
80* Terminate a spawned CLI, including its descendants on Windows. `.cmd`/`.bat`
L81: * shims run under a cmd.exe shell, so killing only the direct child leaves the
L82: * real CLI (e.g. claude.exe) alive and still reading the console — which is
Findings
2 Critical7 High4 Medium4 Low
CriticalAi Agent Control Hijackdist/main.js
CriticalPrevious Version Dangerous Deltadist/local/login-startup.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/local/auto-update-process.js
HighShelldist/commands/cli-agent/cli-process.js
HighCommand Output Exfiltrationdist/commands/pr.js
HighTrigger Reachable Command Output Exfiltrationdist/commands/pr.js
HighRuntime Package Installdist/commands/self-update.js
HighSemantic Analysis Limiteddist/local/attribution-evidence.js#virtual:normalized:round1
MediumDynamic Requiredist/version.js
MediumNetwork
Affected versions and remediation
This report applies to @varveai/adit-cli@1.1.7.
See all versions of @varveai/adit-cli for other recorded verdicts.
- Review the evidence and your use of @varveai/adit-cli@1.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.