agentiqa@1.1.67
AI-powered testing for web and mobile apps
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection contradicts the lifecycle-based alert: preinstall is only a compatibility gate. The bundled CLI is feature-rich but its network, credential, and subprocess behavior is package-aligned and user-invoked.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install runs the Node-version check; explicit CLI login/run commands activate network features.
Impact
No unconsented persistence, foreign control-surface mutation, or exfiltration chain established.
Mechanism
package-owned CLI authentication and test execution
AI rationale
Direct inspection contradicts the lifecycle-based alert: preinstall is only a compatibility gate. The bundled CLI is feature-rich but its network, credential, and subprocess behavior is package-aligned and user-invoked.
Evidence
package.jsonscripts/preinstall.cjsdist/cli.js
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The only install hook is a Node-version gate that exits on Node <18.
- The manifest exposes a CLI; no install-time downloader, shell execution, or configuration mutation is present.
- CLI network and credential handling is tied to explicit login/run functionality and package-owned ~/.agentiqa state.
Evidence against
- Static hints overstate the preinstall hook: it only validates process.versions.node.
- No source evidence of foreign-package overwrite, AI-agent control-surface writes, credential harvesting, or command-output exfiltration was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = agentiqa@1.1.62
matchedIdentity = npm:YWdlbnRpcWE:1.1.62
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsFindings
1 Critical9 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighEntrypoint Foreign Package Code Overwritedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
Affected versions and remediation
This report applies to agentiqa@1.1.67.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.67 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.