registry / blueai-cli / 0.7.0

blueai-cli@0.7.0

BlueAI atomic capabilities CLI

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package invokes concealed code before normal installation. That code performs credential-oriented collection, network dispatch, and detached-process execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the preinstall lifecycle hook.

Impact

Credentials and environment-derived access tokens can be exposed, and the installer can persist beyond the package-manager process.

Mechanism

Obfuscated install-time credential collection and network dispatch with detached process spawning.

Attack narrative

During installation, npm runs `bun run index.js`. The invoked file is a large, one-line obfuscated program rather than CLI setup code. Static inspection shows credential and token discovery logic, HTTP requests, detached child-process spawning, temporary state handling, and broad error suppression. Its final routine runs automatically and exits successfully, making the behavior silent to the installer. A separate postinstall hook also downloads remote specifications into the user configuration cache.

AI rationale

The automatic preinstall execution of concealed credential- and network-capable code is concrete malicious install-hook behavior. Readable CLI functionality and the package-aligned spec cache do not account for the opaque preinstall payload.

Evidence

package.jsonindex.jsdist/lib/spec-cache.jsdist/lib/spec-fetcher.js

OSV advisory

OpenSSF/OSV

package.json declares `"preinstall": "bun run index.js"`, causing npm install to execute a 499KB obfuscator.io-style file via the Bun runtime. index.js uses hex-mangled identifiers, a rotating string array (`_0x71ec`), a PBKDF2-derived key with multi-round RC4/XOR string encryption (class `du`), and installs a decrypt sink on `globalThis`, alongside an embedded base64 blob. The payload contains GitHub API logic that validates a token against `https://api.github.com/user` and enumerates organizations via `/user/orgs`, parsing `X-OAuth-Scopes` for `repo`/`workflow`/`public_repo` and reading `X-GitHub-OAuth-Token-Expiration`, returning a `{valid, user, scopes, expiry, orgs, hasRepoScope, hasWorkflowScope}` structure characteristic of a GitHub personal-access-token harvester. The advertised purpose (a media CLI targeting bluemediagroup.cn endpoints) does not require an obfuscated install-time blob, an alternate runtime, or inspection of installer-owned GitHub credentials; the shipped `dist/` tree is unobfuscated, confirming the preinstall file is an evasion-layered install-time execution channel independent of the library. ## Source: ghsa-malware (845e864164934025d66335978e97186f1ff11821a8b4d7f5c7948da85e0e7f35) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

blueai-cli@0.7.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code