@velaro/cli@1.4.123
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package automatically installs newer CLI code in the background after normal command use, with opt-out controls rather than an explicit update request. The registry is the package's own npm endpoint and the inspected flows show no clear malicious payload, so this is a warning-level risk.
Decision evidence
public snapshot- The CLI starts a background update check and awaits its notice handler after command parsing.
- When the npm registry reports a newer version, registry installs spawn a detached, silent global install of @velaro/cli@latest unless VELARO_NO_AUTO_UPDATE or CI is set.
- The update check contacts the package's npm registry and caches the check result in the Velaro config.
- The postinstall hook only prints a version banner; it does not contact a host or install code.
- The package also offers a user-invoked update command, and the automatic updater uses the package's own npm registry.
- The inspected telemetry flow sends only an action and CLI version with a Velaro token to the configured Velaro API base.
Source & flagged code
10 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @velaro/cli@1.4.123.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.123 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.