@velaro/cli@1.4.91
Velaro Workspace v20 — command-line interface for managing bots, knowledge base ingestion, MCP API keys, search indexes, and ops health.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe lifecycle hook is limited to banner output, and the flagged package installation is in the explicit update command. The credential-bearing screenshot flow is an invoked feature with Velaro staging defaults and a Velaro help API destination, so the inspected signals do not establish an attack.
Decision evidence
public snapshot- package.json defines postinstall as scripts/postinstall.js.
- The CLI entrypoint parses a user command; it does not invoke the update handler automatically.
- The postinstall script imports banner text and the package version for terminal output.
- The inspected xlsx manifest lists test and build scripts, not an install lifecycle hook.
- The update command checks npm and runs a global install only from its command handler.
- The screenshot flow uses supplied or Key Vault credentials, defaults to Velaro staging apps, and uploads an image to the Velaro help API from the article command.
Source & flagged code
9 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage manifest contains a dependency pinned to a remote tarball URL.
package.jsonView on unpkgFindings
Affected versions and remediation
This report applies to @velaro/cli@1.4.91.
See all versions of @velaro/cli for other recorded verdicts.
- Review the evidence and your use of @velaro/cli@1.4.91 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.