@velaro/cli@1.4.118
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe lifecycle hook prints a banner, and the flagged package update is invoked through the CLI. However, saved credentials are sent to an environment-configurable API base without host validation, leaving conditional exposure to a custom endpoint.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user configures a custom API base and invokes a command that uses saved Velaro credentials.
Impact
The configured endpoint can receive the existing Velaro token; the source does not establish that a custom endpoint is malicious.
Mechanism
The command places the saved token in an Authorization header on a request to the configured base.
AI rationale
The lifecycle hook prints a banner, and the flagged package update is invoked through the CLI. However, saved credentials are sent to an environment-configurable API base without host validation, leaving conditional exposure to a custom endpoint.
Evidence
lib/config.jslib/commands/logs.jslib/commands/report-speed.jslib/kb-screenshot.jspackage.jsonscripts/postinstall.jslib/api.jslib/oauth.jslib/commands/update.js
Network endpoints2
api-admin-us-east.velaro.comapi-messaging-us-east.velaro.com
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook runs a script that prints the package banner.
- Log and report-speed requests send the saved Velaro bearer token to the selected messaging API base.
- Environment variables can replace the API base without a host allowlist, so a configured custom endpoint can receive that existing token.
- The affected log and report-speed operations are explicit CLI commands; the screenshot helper also accepts caller-supplied authentication and uploads to its supplied API base.
- OAuth refresh sends the stored refresh token to the Velaro login authority. The PDFKit matches are text and list formatting code.
Evidence against
- The inspected default API bases are Velaro service hosts, and the warning depends on configuring a custom endpoint.
- The package update command checks for an update and runs the global install only when its CLI handler is invoked.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkglib/kb-screenshot.jsView file
Findings
1 Critical8 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltalib/commands/logs.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/deploy-state.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @velaro/cli@1.4.118.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.118 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.