registry / @velaro/cli / 1.4.100
@velaro/cli@1.4.100
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe install hook only prints a banner, and the inspected network and subprocess behaviors are package-aligned updates or user-invoked Velaro operations. Scanner findings do not establish an attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
Installation prints a banner; CLI startup checks for updates; screenshot capture requires invoking its article command; manual update requires invoking the update command.
Impact
The inspected behaviors perform product update and screenshot tasks; no credential disclosure to an unrelated recipient or other attack effect was established.
Mechanism
The install hook prints a banner. The update checker contacts the package's npm registry entry and may update this CLI; screenshot capture uses credentials for Velaro staging and sends the resulting image to the Velaro help API.
AI rationale
The install hook only prints a banner, and the inspected network and subprocess behaviors are package-aligned updates or user-invoked Velaro operations. Scanner findings do not establish an attack surface.
Evidence
package.jsonscripts/postinstall.jsbin/velaro.jslib/update-check.jslib/commands/update.jslib/commands/article.jslib/kb-screenshot.js.lpm-dependency-evidence-e1e7d6a1-7c8f-46c3-9740-3d39f93faf9a/0/package.jsonlib/deploy-state.js
Network endpoints4
registry.npmjs.orgadmin-staging.velaro.commessaging-staging.velaro.comhelp.velaro.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest's postinstall runs scripts/postinstall.js, which imports versioned banner text and writes it to a terminal or stderr.
- The CLI starts a daily update check against the npm registry entry for this package; registry installs update the same package unless CI or the opt-out variable disables it.
- The separate update command installs the latest @velaro/cli release only after the user invokes it.
- The screenshot helper is called with command-line app, route, and article arguments; it uses the supplied login credentials for Velaro staging and uploads the image with a Velaro token to the Velaro help API.
- The screenshot helper invokes a fixed Python script with argument-based execution, and the prepared xlsx manifest shows no install lifecycle hook.
- The deploy-state helper invokes the GitHub CLI with an argument array for its API request.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkglib/kb-screenshot.jsView file
Findings
8 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/deploy-state.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependency
Affected versions and remediation
This report applies to @velaro/cli@1.4.100.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.100 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.