checklist-tui@0.1.4

Write a note. Get a checklist. Check things off in the terminal.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has an intrusive but package-aligned global-install welcome flow and a user-triggered generation request. Source inspection found no concrete malicious chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation or a user action that generates a checklist.

Impact

May disrupt the installer terminal during a global install; no evidence of data theft, persistence beyond app data, or remote payload execution.

Mechanism

TTY welcome UI, local checklist persistence, and user-triggered goal submission.

AI rationale

The package has an intrusive but package-aligned global-install welcome flow and a user-triggered generation request. Source inspection found no concrete malicious chain.

Evidence

package.jsonscripts/postinstall.jsdist/cli.js/dev/tty~/.config/checklist/data.json

Network endpoints1

checklist-tui.vercel.app/api/generate

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

A postinstall hook runs and, for global installs, opens the user's TTY, clears it, and starts the package CLI.
The CLI can POST a user-provided checklist goal to its documented generation endpoint.
Checklist data is stored locally under the user's config directory.

Evidence against

No credential, environment, or arbitrary-file harvesting was found.
No remote code loading, eval, shell execution, or unconsented agent-control-surface mutation was found.
Network use is limited to an explicit checklist-generation action; child process use only plays a macOS sound or invokes explicit update/uninstall commands.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 2 file(s), 50.1 KB of source, external domains: checklist-tui.vercel.app

Source & flagged code

5 flagged

package.jsonView file

Lines 20-54json

20 },

21 "bugs": {

22 "url": "https://github.com/AnushriyaB/checklist-tui/issues"

23 },

24 "bin": {

25 "checklist": "dist/cli.js",

26 "checklist-tui": "dist/cli.js"

27 },

28 "files": [

29 "dist",

30 "scripts/postinstall.js"

31 ],

32 "engines": {

33 "node": ">=18"

34 },

35 "scripts": {

36 "dev": "tsx src/cli.tsx",

37 "typecheck": "tsc --noEmit",

38 "build": "tsup",

39 "prepublishOnly": "npm run build",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "dependencies": {

43 "ink": "^5.0.1",

44 "react": "^18.3.1"

45 },

46 "devDependencies": {

47 "@types/node": "^20.14.0",

48 "@types/react": "^18.3.3",

49 "tsup": "^8.5.1",

50 "tsx": "^4.16.2",

51 "typescript": "^5.5.4"

52 }

53}

dist/cli.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

scripts/postinstall.jsView file

Lines 85-125javascript

85 } catch {

86 return null

87 }

88}

90function writeBanner(fd) {

91 fs.writeSync(fd, '\x1b

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

Findings

3 High3 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/cli.js

HighKnown Malware Source Similarityscripts/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License

LowSuspicious Lifecycle Evidencescripts/postinstall.js

Affected versions and remediation

This report applies to checklist-tui@0.1.4.

See all versions of checklist-tui for other recorded verdicts.

Review the evidence and your use of checklist-tui@0.1.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-18 02:58:45.447Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.