agentiqa@1.1.57
AI-powered testing for web and mobile apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection found a benign preinstall Node-version gate and a package-aligned, explicitly invoked testing CLI. Static signals reflect intended testing, hosted-engine, telemetry, and optional runtime provisioning behavior rather than covert execution or exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation performs only a Node-version check; CLI features require an explicit agentiqa command.
Impact
The CLI can send user-supplied test credentials and test data to the configured Agentiqa service as part of requested runs.
Mechanism
user-invoked AI testing CLI with hosted API/engine integration
AI rationale
Direct inspection found a benign preinstall Node-version gate and a package-aligned, explicitly invoked testing CLI. Static signals reflect intended testing, hosted-engine, telemetry, and optional runtime provisioning behavior rather than covert execution or exfiltration.
Evidence
package.jsonscripts/preinstall.cjsdist/cli.js~/.agentiqa/config.json~/.agentiqa/credentials.json~/.agentiqa/events-queue.ndjson
Network endpoints3
agentiqa.comengine.agentiqa.coms.agentiqa.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- scripts/preinstall.cjs only enforces Node.js >=18 and exits on older versions.
- package.json exposes dist/cli.js as an explicit user CLI; no import-time entrypoint is declared.
- dist/cli.js documents and implements AI-powered web/mobile test commands and authenticated Agentiqa API/engine calls.
- CLI writes only package-owned ~/.agentiqa settings, telemetry queue, credentials, and user-requested test artifacts.
- Child-process use is for adb/xcrun detection, ffmpeg rendering, and optional mobile-test dependency provisioning during runtime.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
5`)+`
L6: `}import{spawn as Roe}from"node:child_process";import{mkdirSync as koe,writeFileSync as Coe,existsSync as Noe,statSync as Ooe}from"node:fs";import{tmpdir as Poe}from"node:os";impor...
L7: `);for(let[n,r]of Uj)if(n.test(e))return r}function $j(t){let e=t.map(s=>s.text).join(`
High
Findings
7 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
Affected versions and remediation
This report applies to agentiqa@1.1.57.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.57 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.