registry / @wirecat/max-cli / 0.98.0
@wirecat/max-cli@0.98.0
MAX Messenger bots through the official Bot API, and a personal MAX account, from the terminal — built for agents and scripts
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe Windows installation flow automatically writes the package’s own agent skill to user-level agent folders when run with its default settings, a warning-level agent extension lifecycle risk. I found no evidence in the inspected paths of credential redirection, unrelated data collection, or remote payload execution.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Run the Windows installer with its default agent selection during package installation.
Impact
Agent instruction files are added under the user’s `.claude` and `.agents` skill directories, changing what those agents can read about this CLI.
Mechanism
The installer sets `MAX_INSTALL_AGENT=all`; the postinstall hook then writes the skill for the selected targets.
AI rationale
The Windows installation flow automatically writes the package’s own agent skill to user-level agent folders when run with its default settings, a warning-level agent extension lifecycle risk. I found no evidence in the inspected paths of credential redirection, unrelated data collection, or remote payload execution.
Evidence
install/windows.ps1dist/install/postinstall.js~/.claude/skills/max-cli/SKILL.md~/.agents/skills/max-cli/SKILL.md
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The Windows installer defaults its agent target to `all`.
- The installer passes that selection to npm as `MAX_INSTALL_AGENT`.
- During installation, the Windows installer runs `max skill install` for the selected agent targets.
- The postinstall hook writes the skill when `MAX_INSTALL_AGENT` is set to an accepted target.
Evidence against
- The package describes itself as a MAX Messenger CLI, and its provider defaults are the official OpenAI and Anthropic API endpoints.
- The postinstall hook skips agent-skill installation when `MAX_INSTALL_AGENT` is unset or `none`.
- The flagged gateway-like hostnames appear in example commands, and I found no credential redirect or decoded remote payload execution in the inspected paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
17 flaggedpackage.jsonView file
•scripts.postinstall = node install/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node install/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/online.jsView file
1import { spawn } from "node:child_process";
L2: import { createInterface } from "node:readline";
High
Findings
4 Critical9 High7 Medium6 Low
CriticalRemote Asset Decode Executedist/bundle/program-TEIM6RFW.js
CriticalTrojan Source Unicodedist/bundle/chunk-MNUJFHLT.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundle/program-TEIM6RFW.js
CriticalPrevious Version Dangerous Deltadist/bundle/program-TEIM6RFW.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/online.js
HighSame File Env Network Executiondist/bundle/program-TEIM6RFW.js
HighCredential Redirect Persistencedist/bundle/program-TEIM6RFW.js
HighSandbox Evasion Gated Capabilitydist/bundle/program-TEIM6RFW.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/bundle/chunk-SN45Z53S.js
Affected versions and remediation
This report applies to @wirecat/max-cli@0.98.0.
See all versions of @wirecat/max-cli for other recorded verdicts.
- Review the evidence and your use of @wirecat/max-cli@0.98.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.