registry / @velaro/cli / 1.4.133
@velaro/cli@1.4.133
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe postinstall hook is a banner, and the flagged command execution in `update` is user-invoked. However, normal CLI startup can silently launch a detached global self-update by default, so this is a user-visible software-modification risk that warrants a warning rather than a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
A registry-installed CLI invocation after the daily check interval, when npm reports a newer version and CI and the opt-out variable are unset.
Impact
A CLI invocation can replace the installed package and run the new release’s installation behavior without an explicit update request.
Mechanism
It fetches the latest version from npm, then launches a detached, silent global npm install of @velaro/cli@latest.
AI rationale
The postinstall hook is a banner, and the flagged command execution in `update` is user-invoked. However, normal CLI startup can silently launch a detached global self-update by default, so this is a user-visible software-modification risk that warrants a warning rather than a malicious verdict.
Evidence
bin/velaro.jslib/update-check.jslib/config.js~/.velaro/config.jsonGlobal @velaro/cli installation (npm-prefix dependent)
Network endpoints1
registry.npmjs.org/@velaro/cli/latest
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI starts the update check during startup and awaits its result after command parsing.
- The checker contacts the official npm registry once per day and caches the latest version and check time in the user config.
- When a newer version is found, a registry install can launch a detached, silent global `npm install -g @velaro/cli@latest` unless opt-out or CI is set.
- The package’s explicit `velaro update` command also installs from the official npm registry, but only when that command is invoked.
Evidence against
- The postinstall hook prints a version banner; the inspected hook does not contact the network or collect data.
- The automatic check contacts the package’s own npm registry endpoint and stores version-check metadata, not credentials or machine details.
- The automatic install is limited to registry installs and is skipped in CI or when `VELARO_NO_AUTO_UPDATE` is set.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkglib/kb-screenshot.jsView file
Findings
8 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/deploy-state.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirelib/track.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @velaro/cli@1.4.133.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.133 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.