agentiqa@1.1.71
AI-powered testing for web and mobile apps
AI Security Review
scanned 2mo ago · by lpm-firewall-aiStatic inspection found a benign Node-version preinstall gate and package-aligned CLI functionality. The scanner signals reflect capabilities of an AI testing client, not a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation or explicit CLI testing commands.
Impact
No unconsented install-time mutation or exfiltration was confirmed.
Mechanism
User-invoked testing, browser, and device operations.
AI rationale
Static inspection found a benign Node-version preinstall gate and package-aligned CLI functionality. The scanner signals reflect capabilities of an AI testing client, not a concrete malicious chain.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest runs a preinstall script.
- The CLI includes a fixed-command helper for local mobile-device discovery.
Evidence against
- Preinstall only rejects Node versions below 18; it does not download, modify, or persist anything.
- The inspected CLI behavior is a user-invoked testing client with package-aligned API, browser, and device operations.
- No self-dependency, install-time network access, credential harvesting, or foreign AI-agent configuration mutation was found.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node scripts/preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
1#!/usr/bin/env node
L2: var C$=Object.create;var TE=Object.defineProperty;var N$=Object.getOwnPropertyDescriptor;var O$=Object.getOwnPropertyNames;var P$=Object.getPrototypeOf,L$=Object.prototype.hasOwnPr...
L3: ${n.message}`),r?new XH.VercelOidcTokenError(r):n}return t}function kg(){let t=(0,JH.getContext)().headers?.["x-vercel-oidc-token"]??process.env.VERCEL_OIDC_TOKEN;if(!t)throw new E...
...
L5: `)+`
L6: `}import{spawn as Kpe}from"node:child_process";import{mkdirSync as Ype,writeFileSync as Jpe,existsSync as Xpe,statSync as Qpe}from"node:fs";import{tmpdir as Zpe}from"node:os";impor...
L7: `);for(let[n,r]of tB)if(n.test(e))return r}function GE(t){let e=t.map(s=>s.text).join(`
Findings
7 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighRemote Agent Bridgedist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to agentiqa@1.1.71.
See all versions of agentiqa for other recorded verdicts.
- Review the evidence and your use of agentiqa@1.1.71 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.