registry / @velaro/cli / 1.4.120
@velaro/cli@1.4.120
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe postinstall hook only prints a version banner. The flagged network, credential and process operations serve explicit CLI commands, with staff checks and confirmation for inspected log mutations.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The install hook prints a banner. Network and account operations occur when the user invokes corresponding CLI commands.
Impact
No unauthorized data transfer or action was identified.
Mechanism
The hook reads the package version and writes a banner; runtime commands use credentials with Velaro services, and mutating log operations require confirmation.
AI rationale
The postinstall hook only prints a version banner. The flagged network, credential and process operations serve explicit CLI commands, with staff checks and confirmation for inspected log mutations.
Network endpoints5
registry.npmjs.org/@velaro/cli/latest{msgBase}/superadmin/logs/search{msgBase}/superadmin/logs/stream{vaultName}.vault.azure.net{adminApiBase}/api/kb/articles/upload-image
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall hook runs a script that formats and prints a version banner.
- The logs command checks for the Velaro staff site before sending the stored token to the configured messaging API.
- Log alert creation and changes require an explicit `--yes` flag; without it, the command shows a dry run.
- The update command checks the npm registry and runs `npm install -g @velaro/cli@latest` when invoked.
Evidence against
- The package defines a postinstall script, but its inspected code only prints a banner.
- The package includes network access, credential use and process execution, but the inspected flows serve explicit CLI functions.
- The version adds a logs command with account-management operations, but those operations are exposed as subcommands and guarded by confirmation where they mutate data.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkglib/kb-screenshot.jsView file
Findings
1 Critical8 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltalib/commands/logs.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/deploy-state.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @velaro/cli@1.4.120.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.120 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.