registry / @wirecat/max-cli / 0.83.0
@wirecat/max-cli@0.83.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe global-install lifecycle can write the package's own agent skill into user-level agent directories when an agent target is selected. The hook skips that write when MAX_INSTALL_AGENT is unset, and the inspected code shows no unrelated credential or data exfiltration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The global npm postinstall runs with MAX_INSTALL_AGENT set to an agent target; the Windows installer can set this during installation.
Impact
This adds package instructions to the selected agent's skill set, an install-time configuration change that users should know about.
Mechanism
The hook copies SKILL.md into the selected agent skill directory under the user's home folder.
AI rationale
The global-install lifecycle can write the package's own agent skill into user-level agent directories when an agent target is selected. The hook skips that write when MAX_INSTALL_AGENT is unset, and the inspected code shows no unrelated credential or data exfiltration.
Evidence
package.jsoninstall/postinstall.mjsdist/install/postinstall.js.lpm-dependency-evidence-0e3d1b80-bc86-4994-a7d9-a09c01142e48/0/npm-linux/dist/skill/index.js~/.claude/skills/max-cli/SKILL.md~/.agents/skills/max-cli/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook proceeds only for global npm installs.
- When MAX_INSTALL_AGENT is set to an agent target, the hook calls installSkill for Claude and/or shared agent directories.
- The skill installer writes the package's SKILL.md into the selected agent's home skills directory.
Evidence against
- With MAX_INSTALL_AGENT unset or set to none, the hook skips agent skill installation.
- Browser login starts through an explicit session command and uses a temporary browser profile that is removed afterward.
- The inspected install and login paths show no unrelated credential collection or external reporting.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/session/browser.jsView file
1import { spawn } from "node:child_process";
L2: import { existsSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
...
L9: };
L10: const WEB_MAX = "https://web.max.ru/";
L11: const AUTH_KEY = "__oneme_auth";
...
L17: export const findChromium = () => {
L18: const named = process.env.MAX_BROWSER;
L19: if (named)
L20: return named;
L21: if (process.platform === "darwin") {
L22: return [
...
L129: // Chrome writes to the profile while it shuts down; removing it first leaves half of it behind.
Findings
4 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitydist/session/browser.js
HighSemantic Analysis Limiteddist/bot/transport.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/client/values.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall/windows.ps1
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @wirecat/max-cli@0.83.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.83.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.