registry / AI-agent capability abuse / delimit-cli / 4.19.6

delimit-cli@4.19.6

The merge gate for AI-written code, with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package exposes a persistent AI-tool and Git interception capability through an explicitly confirmed command. Its postinstall hook does not perform that mutation and sends telemetry only when opt-in is enabled.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs `delimit install`, declines dry-run mode, and confirms the prompt.

Impact

The command can intercept later Git and supported AI-tool activity through locally generated hooks.

Mechanism

Explicit global hook and shell-profile installation.

AI rationale

Evidence

bin/delimit-cli.jslib/hooks-installer.js~/.delimit/hooks~/.claude.json~/.bashrc

Network endpoints1

127.0.0.1:7823

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The install lifecycle only posts telemetry after an affirmative environment-variable opt-in.
The explicit `delimit install` command presents global Git, shell, and AI-hook changes and requires confirmation before applying them.
The hook installer can set a global Git hook path, add hook entries to an existing Claude configuration, and append a source command to `.bashrc`.

Evidence against

No unconsented install-time configuration mutation was found; postinstall otherwise prints setup guidance.
The observed network destination for generated governance hooks is a localhost agent.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 34 file(s), 879 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.lemonsqueezy.com, api.meta.ai, api.openai.com, api.x.ai, app.delimit.ai, delimit.ai, generativelanguage.googleapis.com, github.com, img.shields.io, jsonfeed.org, python.org, registry.npmjs.org, us-central1-aiplatform.googleapis.com

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os'); L15: // Shared prompt gate: false when stdin/stdout is not a TTY, CI is set, L16: // DELIMIT_NON_INTERACTIVE is set, or the user passed --yes. Every prompt ... L19: const SETUP_INTERACTIVE = isInteractive({ yes: process.argv.includes('--yes') || process.argv.includes('-y') }); L20: const DELIMIT_HOME = path.join(os.homedir(), '.delimit'); L21: const MCP_CONFIG = path.join(os.homedir(), '.mcp.json'); ... L107: // Self-update check: ensure we're running the latest version (skip if already re-execed) L108: const _pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8')); L109: if (!process.env.DELIMIT_SETUP_UPDATED) { L110: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/delimit-setup.jsView on unpkg · L12

113log(dim(` Updating delimit-cli ${_pkg.version} -> ${latest}...`)); L114: execSync('npm install -g delimit-cli@latest 2>/dev/null', { stdio: 'pipe', timeout: 30000 }); L115: execSync('delimit-cli setup', { stdio: 'inherit', env: { ...process.env, DELIMIT_SETUP_UPDATED: '1' } });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/delimit-setup.jsView on unpkg · L113

10*/ L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/delimit-setup.jsView on unpkg · L10

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/delimit-setup.jsView on unpkg · L12

lib/proxy-handler.jsView file

7L8: const { spawn } = require('child_process'); L9: const axios = require('axios'); L10: const path = require('path'); ... L12: L13: const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`; L14:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/proxy-handler.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/proxy-handler.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/proxy-handler.jsView on unpkg

bin/delimit-cli.jsView file

63} L64: if (!config.mcpServers) config.mcpServers = {}; L65: if (!config.mcpServers.delimit) { L66: const python = process.platform === 'win32' ? 'python.exe' : 'python3'; ... L71: L72: config.mcpServers.delimit = { L73: command: python, ... L84: } L85: fs.writeFileSync(antigravityConfig, JSON.stringify(config, null, 2)); L86: } ... L476: // --- MCP --- L477: const mcpConfigPath = path.join(homedir, '.mcp.json');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/delimit-cli.jsView on unpkg · L63

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = bin/delimit-cli.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit-cli.jsView on unpkg

lib/cross-model-hooks.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ion migratetonestedformat(hookgroup) { if (hookgroup.hooks && array.isarray(hookgroup.hooks)) { return hookgroup; } const nested = { matcher: hookgroup.matcher || '' }; if (hookgroup.if) nested.if = hookgroup.if; nested.hooks = [{ type: hookgroup.type || 'command', command: hookgroup.command }]; return nested; }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/cross-model-hooks.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/cross-model-hooks.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/cross-model-hooks.jsView on unpkg

lib/auth-setup.jsView file

11Trigger-reachable persistence chain: manifest.bin -> bin/delimit-cli.js -> lib/auth-setup.js L11: const crypto = require('crypto'); L12: const { execSync } = require('child_process'); L13: const chalk = require('chalk'); ... L16: constructor() { L17: this.configDir = path.join(process.env.HOME, '.delimit'); L18: this.credentialsFile = path.join(this.configDir, 'credentials.enc'); ... L183: console.log(chalk.gray('\n Required scopes for full functionality:')); L184: console.log(chalk.gray(' • repo (Full control of private repositories)')); L185: console.log(chalk.gray(' • workflow (Update GitHub Action workflows)')); ... L281: L282: mcp[server].endpoint = await this.prompt(' Endpoint URL (http://localhost:8080): ', 'http://localhost:8080'); L283: }

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/auth-setup.jsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/auth-setup.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/auth-setup.jsView on unpkg

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView file

•path = gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.so kind = native_binary sizeBytes = 2646312 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

gateway/ai/deliberation.cpython-310-x86_64-linux-gnu.soView on unpkg

bin/delimit-os.shView file

•path = bin/delimit-os.sh kind = build_helper sizeBytes = 3481 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/delimit-os.shView on unpkg

lib/agent.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/agent.js#virtual:normalized:round1View on unpkg

lib/hooks-installer.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/hooks-installer.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hooks-installer.jsView on unpkg

lib/agent.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/agent.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/agent.jsView on unpkg

lib/api-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/api-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/api-engine.jsView on unpkg

lib/attest-mcp.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/attest-mcp.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/attest-mcp.jsView on unpkg

lib/wrap-engine.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/wrap-engine.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/wrap-engine.jsView on unpkg

bin/delimit.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = bin/delimit.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/delimit.jsView on unpkg

lib/session-shell.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = lib/session-shell.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/session-shell.jsView on unpkg

scripts/clean-tree-guard.jsView file

•matchType = normalized_sha256 matchedPackage = delimit-cli@4.19.0 matchedPath = scripts/clean-tree-guard.js matchedIdentity = npm:ZGVsaW1pdC1jbGk:4.19.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/clean-tree-guard.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/delimit-setup.jsView file

12const path = require('path'); L13: const { execSync } = require('child_process'); L14: const os = require('os');

High

Child Process

Package source references child process execution.

bin/delimit-setup.jsView on unpkg · L12

Findings

1 Critical21 High8 Medium5 Low

CriticalAi Agent Control Hijackbin/delimit-cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/delimit-setup.js

HighShell

HighSame File Env Network Executionlib/proxy-handler.js

HighSandbox Evasion Gated Capabilitybin/delimit-setup.js

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/cross-model-hooks.js

HighTrigger Reachable Persistencelib/auth-setup.js

HighRuntime Package Installbin/delimit-setup.js

HighSemantic Analysis Limitedlib/agent.js#virtual:normalized:round1

HighKnown Malware Source Similaritybin/delimit-cli.js

Affected versions and remediation

This report applies to delimit-cli@4.19.6.

See all versions of delimit-cli for other recorded verdicts.

Review the evidence and your use of delimit-cli@4.19.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 22:06:50.526Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code