registry / checklist-tui / 0.1.3

checklist-tui@0.1.3

Write a note. Get a checklist. Check things off in the terminal.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A global npm postinstall takes over the invoking shell terminal, clears it, and runs the package UI. It then starts a detached process to clear and rewrite that terminal after npm exits.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install -g checklist-tui in an interactive non-CI shell

Impact

Unconsented terminal hijacking and interruption during installation.

Mechanism

postinstall TTY discovery, terminal clearing, and detached relaunch

Attack narrative

The install hook walks parent processes to discover the real user TTY, opens it read/write, clears the screen, and synchronously launches the CLI during a global installation. It then launches a detached copy of itself with the TTY path and clears/writes the terminal again after npm completes. This is not needed for installation and disrupts the user's active shell without a user command.

Rationale

The package embeds deliberate, unconsented terminal takeover in postinstall, including a detached follow-up process. Although no exfiltration was found, this concrete install-time behavior is malicious.

Evidence

package.jsonscripts/postinstall.jsdist/cli.js

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

checklist-tui@0.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code