@velaro/cli@1.4.147
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package is not clearly malicious: its install hook only prints a banner and the credential-bearing API requests serve Velaro CLI functions. However, it sends command-level usage telemetry after successful commands without a user-facing disclosure or opt-out, so this version warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
Successful commands wrapped by runCommand trigger telemetry; CLI startup performs a daily update check.
Impact
Command usage is associated with the authenticated Velaro account, and registry installs can be replaced by a newer release without an explicit update command.
Mechanism
The tracker sends the command name and CLI version with the stored Velaro bearer token. The update checker can launch a detached npm install of the latest @velaro/cli.
AI rationale
The package is not clearly malicious: its install hook only prints a banner and the credential-bearing API requests serve Velaro CLI functions. However, it sends command-level usage telemetry after successful commands without a user-facing disclosure or opt-out, so this version warrants a warning.
Evidence
lib/run.jslib/track.jslib/update-check.js~/.velaro/config.json
Network endpoints2
creds.apiBase/ToolUsage/cliregistry.npmjs.org/@velaro/cli/latest
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The postinstall hook prints a version banner; it does not make a network request.
- After successful wrapped commands, the CLI calls its usage tracker with the command name.
- The tracker posts the command name and CLI version to the configured API base using the stored Velaro token, with no user-facing disclosure or opt-out found.
- On CLI startup, registry installs can automatically install the latest package version in the background unless CI or VELARO_NO_AUTO_UPDATE is set.
Evidence against
- The package is a Velaro management CLI, and the tracking destination is its configured Velaro API rather than an unrelated collector.
- The screenshot command’s credential retrieval and article update flows are tied to an explicit screenshot request.
- The postinstall behavior is limited to printing a banner.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•Remote tarball dependency specs: xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz
Medium
Remote Tarball Dependency
Package manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkglib/kb-screenshot.jsView file
Findings
8 High6 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/kb-screenshot.js
HighShell
HighSame File Env Network Executionlib/kb-screenshot.js
HighCommand Output Exfiltrationlib/commands/update.js
HighTrigger Reachable Command Output Exfiltrationlib/commands/update.js
HighRuntime Package Installlib/commands/update.js
HighSemantic Analysis Limitedlib/deploy-state.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirelib/track.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @velaro/cli@1.4.147.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.147 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.