registry  /  datpaq  /  1.0.1

datpaq@1.0.1

Official CLI for the Datpaq API

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. The package uses a common CLI wrapper pattern: postinstall fetches a platform binary, and the bin entry executes it when the user runs datpaq.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user invokes datpaq CLI
Impact
Installs and runs the datpaq CLI binary; binary contents are not inspectable from this source package alone.
Mechanism
version-pinned GitHub release binary download and local CLI wrapper execution
Rationale
Source inspection shows install-time network download and binary execution, but both are tightly aligned with an official CLI package and pinned to the package version. No concrete exfiltration, persistence, unauthorized agent-control mutation, or hidden install/import-time behavior is present in the JavaScript source.
Evidence
package.jsoninstall.jsrun.jsbin/datpaqbin/datpaq.exeos.tmpdir()/datpaq_1.0.1_<platform>_<arch>.<archive>
Network endpoints1
github.com/datpaq/cli/releases/download/v1.0.1/datpaq_<platform>_<arch>.<archive>

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
  • package.json defines postinstall: node install.js
  • install.js downloads release archive from GitHub and extracts datpaq binary into package bin/
  • run.js executes the installed package binary with user CLI args
Evidence against
  • Only three package files present: package.json, install.js, run.js
  • install.js URL is version-pinned to https://github.com/datpaq/cli/releases/download/v1.0.1/datpaq_...
  • No env/credential harvesting, home/project agent config writes, persistence, or destructive actions found
  • Network use is package-aligned binary download during install
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.50 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings