checklist-tui@0.1.5
Write a note. Get a checklist. Check things off in the terminal.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a concrete intrusive postinstall side effect unrelated to required installation work. Its runtime network and local storage behavior are aligned with the checklist app, so blocking is not warranted.
Static reason
One or more suspicious static signals were detected.
Trigger
npm global installation
Impact
Disrupts the user's active terminal during installation.
Mechanism
postinstall TTY discovery, ANSI screen clearing, and delayed detached child
AI rationale
The package has a concrete intrusive postinstall side effect unrelated to required installation work. Its runtime network and local storage behavior are aligned with the checklist app, so blocking is not warranted.
Evidence
package.jsonscripts/postinstall.jsdist/cli.js/dev/tty
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Global-install postinstall walks parent processes to locate the user's terminal.
- The hook clears that terminal and spawns a detached delayed child that clears it again.
Evidence against
- No credential harvesting, data exfiltration, eval, or remote payload execution found.
- Runtime network request sends only a user-supplied checklist goal when generation is invoked.
- Checklist data is stored locally in ~/.config/checklist/data.json.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
UrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/cli.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli.jsView on unpkgFindings
2 High3 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to checklist-tui@0.1.5.
See all versions of checklist-tui for other recorded verdicts.
- Review the evidence and your use of checklist-tui@0.1.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.