registry  /  @whatevertogo/astrcode  /  0.3.10

@whatevertogo/astrcode@0.3.10

AI-powered coding assistant CLI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Postinstall materializes the matching declared platform binary at the package-owned CLI path. No confirmed malicious behavior or external control-surface mutation is established.

Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall during package installation
Impact
Installs the package CLI executable only.
Mechanism
Resolve, hard-link or copy an installed optional-dependency binary into `bin/astrcode`
Rationale
The postinstall script is a package-aligned platform-binary installer and is limited to its own CLI path. Directly inspected source shows no exfiltration, remote payload retrieval, destructive behavior, or foreign AI-agent control-surface mutation.
Evidence
package.jsoninstall.jsbin/astrcodebin/astrcode.exe

Decision evidence

public snapshot
AI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for block
  • `package.json` runs `node install.js` via `postinstall`.
  • `install.js` links or copies a platform-specific optional-dependency binary into `bin/astrcode`.
Evidence against
  • `install.js` only resolves six declared `@whatevertogo/astrcode-*` optional packages; it makes no network requests.
  • No credential, environment, or arbitrary file harvesting is present.
  • No shell execution, eval, dynamic remote loading, persistence, or AI-agent configuration writes are present.
  • The lifecycle action is limited to the package-owned `bin/` path.
  • `bin/astrcode` is a placeholder that exits until the package-owned installer supplies the binary.
Behavioral surface
Source
Filesystem
Supply chainNo supply-chain packaging signals triggered.
Manifest
CopyleftLicense
scanned 1 file(s), 1.60 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
LowScripts Present
LowFilesystem
LowCopyleft License