registry  /  @youdie006/swapdex  /  0.1.1

@youdie006/swapdex@0.1.1

Switch between multiple Claude Code and Codex login accounts, locally and safely.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Install-time code fetches and installs a remote native executable that is not present in the npm tarball. No confirmed malicious JS behavior or AI-agent control-surface mutation is present in inspected source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user later runs swapdex CLI
Impact
Unverified remote binary becomes executable package payload; behavior cannot be validated from included source
Mechanism
postinstall remote binary downloader and CLI shim
Attack narrative
On install, install.js selects an OS/CPU target, downloads a tar.gz from the package author's GitHub release, extracts it into bin/, chmods bin/swapdex, and deletes the temp archive. The npm package only contains the downloader and JS shim, so the executable payload is staged outside the reviewed package contents.
Rationale
This is a real install-time remote executable delivery pattern without integrity verification, but the endpoint is package-aligned and inspected source does not show exfiltration, persistence, destructive behavior, or unconsented AI-agent control hijack. Warn rather than block because the unresolved risk is the remote native payload, not confirmed malicious source behavior.
Evidence
package.jsoninstall.jsbin/swapdex.jsbin/bin/swapdex/tmp/swapdex-${target}.tar.gz
Network endpoints1
github.com/youdie006/swapdex/releases/download/v${version}/swapdex-${target}.tar.gz

Decision evidence

public snapshot
AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node install.js
  • install.js downloads platform tar.gz from GitHub release during install
  • install.js extracts archive with tar and chmods bin/swapdex executable
  • Downloaded native binary is not included in package for source inspection
Evidence against
  • Network endpoint is package-aligned GitHub release URL
  • bin/swapdex.js only invokes local bin/swapdex with forwarded argv
  • No source writes to Claude/Codex agent config or broad AI-agent control surfaces
  • No credential harvesting or exfiltration logic visible in shipped JS
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.12 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings