agentiqa@1.1.62
AI-powered testing for web and mobile apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner conflates normal runtime CLI capabilities with install-time behavior. Direct inspection found a benign preinstall version gate and no concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs the version check; users must invoke CLI login/run commands for network or automation features.
Impact
No unconsented install-time mutation or data exfiltration established.
Mechanism
User-invoked testing CLI with authenticated API and local browser tooling.
AI rationale
The scanner conflates normal runtime CLI capabilities with install-time behavior. Direct inspection found a benign preinstall version gate and no concrete malicious chain.
Evidence
package.jsonscripts/preinstall.cjsdist/cli.js
Network endpoints3
agentiqa.comengine.agentiqa.comregistry.npmjs.org/-/package/agentiqa/dist-tags
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json preinstall only runs scripts/preinstall.cjs.
- scripts/preinstall.cjs only rejects Node.js versions below 18.
- dist/cli.js network, browser automation, and child-process use are runtime CLI features.
- dist/cli.js defaults its API to https://agentiqa.com; alternate API URLs require explicit login/env input.
- No install-time credential collection, exfiltration, foreign-package overwrite, or agent-config mutation found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
5`)+`
L6: `}import{spawn as Gce}from"node:child_process";import{mkdirSync as qce,writeFileSync as Hce,existsSync as Wce,statSync as zce}from"node:fs";import{tmpdir as Kce}from"node:os";impor...
L7: `);for(let[n,r]of f2)if(n.test(e))return r}function Lw(t){let e=t.map(s=>s.text).join(`
High
Findings
9 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to agentiqa@1.1.62.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.62 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.