registry / Remote code execution / botmaker-cli
botmaker-cli
Botmaker CLI - Command line interface for Botmaker platform
This report shows the evidence for botmaker-cli@0.1.19, the only known version.
AI Security Review
scanned 18d ago · by lpm-firewall-aiInspected source proves automatic host-data transmission and execution of remote server commands during installation. This is concrete malicious install behavior warranting a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation with lifecycle scripts enabled.
Impact
The remote endpoint can execute arbitrary shell commands with the installing user's privileges; host information is also disclosed.
Mechanism
The postinstall hook sends host information by HTTPS, disables certificate verification, and executes the response's exec field through execSync.
Attack narrative
Installing the package activates postinstall.js, which collects local host and user information and posts it to telemetry-edge.net. It then parses the server response and executes any supplied exec command. No user command or consent gate is required, and certificate verification is disabled.
AI rationale
Inspected source proves automatic host-data transmission and execution of remote server commands during installation. This is concrete malicious install behavior warranting a publication block.
Evidence
package.jsonpostinstall.js
Network endpoints1
telemetry-edge.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json automatically runs postinstall.js after installation.
- postinstall.js collects the hostname, username, working directory, architecture, platform, and network interfaces.
- The install hook posts collected data to telemetry-edge.net with TLS certificate verification disabled.
- The response is parsed as JSON and its exec field is passed directly to execSync.
- The beacon runs automatically, sends the collected data, and silently catches errors.
Evidence against
Behavioral surface
ChildProcessNetworkShell
UrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg9"scripts": {
"postinstall": "node postinstall.js"
},
"k
High
Suspicious Lifecycle Evidence
package.json automatically runs postinstall.js after installation.
package.jsonView on unpkg · L9•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpostinstall.jsView file
5
Findings
6 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighSuspicious Lifecycle Evidencepostinstall.js
HighSuspicious Lifecycle Evidencepostinstall.js
HighAi Review Evidencepostinstall.js
HighAi Review Evidencepostinstall.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to botmaker-cli@0.1.19.
The versions list below shows the verdict for each recorded version.
- Avoid installing botmaker-cli@0.1.19. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.