registry / doc-fetch-cli / 2.5.6

doc-fetch-cli@2.5.6

Dynamic documentation fetching CLI that converts entire documentation sites to single markdown files for AI/LLM consumption

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install-time code fetches an unsigned native executable, then the user-facing CLI executes that binary. This is an unverified staged payload path, but inspected scripts show no concrete credential theft, destructive action, or foreign control-surface mutation.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall followed by explicit `doc-fetch` execution

Impact

A release or redirect compromise can substitute code executed by the CLI user.

Mechanism

downloads an unsigned release binary and spawns it

Rationale

The unsigned install-time binary replacement is a material remote-payload risk, but source inspection does not establish concrete malicious behavior. Warn rather than block.

Evidence

package.jsonbin/postinstall.jsbin/doc-fetch.jsbin/install.jsdoc-fetchdoc-fetch_linux_amd64bin/doc-fetch_linux_amd64

Network endpoints1

github.com/AlphaTechini/doc-fetch/releases/download/v2.5.6/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`package.json` runs `bin/postinstall.js` on install.
`bin/postinstall.js` downloads an executable from GitHub Releases without checksum/signature validation.
Postinstall writes the download as executable and follows redirect locations.
`bin/doc-fetch.js` selects and spawns the downloaded/platform binary.
Root `doc-fetch` differs from bundled Linux binary, consistent with a fetched replacement.

Evidence against

The initial download URL is version-pinned to the package publisher's GitHub release.
Postinstall writes only the package-local binary and wrapper.
No inspected JS harvests credentials, reads user secrets, alters AI-agent configs, or establishes persistence.
`bin/install.js` is not referenced by the manifest lifecycle scripts.

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 22.8 KB of source, external domains: docfetch.dev, github.com, golang.org, www.google.com, www.sitemaps.org, www.w3.org

Source & flagged code

6 flagged

package.jsonView file

Lines 1-29json

2 "name": "doc-fetch-cli",

3 "version": "2.5.6",

4 "description": "Dynamic documentation fetching CLI that converts entire documentation sites to single markdown files for AI/LLM consumption",

5 "bin": {

6 "doc-fetch": "./bin/doc-fetch.js"

7 },

8 "scripts": {

9 "prepublishOnly": "node ./scripts/verify-binaries.js",

10 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "verify": "node ./scripts/verify-binaries.js"

12 },

13 "repository": {

14 "type": "git",

15 "url": "https://github.com/AlphaTechini/doc-fetch.git"

16 },

17 "homepage": "https://doc-fetch.vercel.app/",

18 "keywords": [

19 "documentation",

20 "ai",

21 "llm",

22 "markdown",

23 "crawler",

24 "security"

25 ],

26 "author": "AlphaTechini",

27 "license": "MIT"

28}

bin/install.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2const os = require('os');

3const path = require('path');

4const { execSync } = require('child_process');

5const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L3

6const https = require('https');

7const { pipeline } = require('stream');

8const { promisify } = require('util');

10const finished = promisify(pipeline);

12// Security: Validate and sanitize output paths

13function validateOutputPath(filePath) {

14 // Resolve to absolute path

15 const absPath = path.resolve(filePath);

17 // Get current working directory

18 const cwd = process.cwd();

20 // Ensure the path is within the current directory or a subdirectory

21 if (!absPath.startsWith(cwd)) {

22 throw new Error('Output path must be within current directory or subdirectories');

23 }

bin/doc-fetch.jsView file

Lines 33-73javascript

33 'doc-fetch_linux_amd64',

34 'doc-fetch_linux_arm64',

35];

37let binaryPath = null;

38for (const name of possibleBinaries) {

39 const testPath = path.join(packageDir, name);

40 if (fs.existsSync(testPath)) {

41 binaryPath = testPath;

42 break;

43 }

44}

46if (!binaryPath) {

47 console.error('❌ doc-fetch binary not found!');

48 console.error('');

49 console.error('💡 Platform:', platform, '(' + process.arch + ')');

50 console.error('💡 Searched in:', packageDir);

51 console.error('');

52 console.error('💡 Try reinstalling:');

53 console.error(' npm uninstall -g doc-fetch-cli');

54 console.error(' npm install -g doc-fetch-cli@latest');

55 process.exit(1);

56}

58const args = process.argv.slice(2);

60// Spawn the Go binary

61const child = spawn(binaryPath, args, {

62 stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/doc-fetch.jsView on unpkg · L53

63});

65child.on('error', (err) => {

66 if (err.code === 'ENOENT') {

67 console.error('❌ Failed to execute binary');

68 console.error(' Path:', binaryPath);

69 console.error(' Error: File not found or no execute permission');

70 if (platform !== 'win32') {

71 console.error('');

72 console.error('💡 Fix permissions: chmod +x "' + binaryPath + '"');

73 }

doc-fetch_linux_amd64View file

•path = doc-fetch_linux_amd64 kind = native_binary sizeBytes = 9168802 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

doc-fetch_linux_amd64View on unpkg

bin/postinstall.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = doc-fetch-cli@2.5.2 matchedIdentity = npm:ZG9jLWZldGNoLWNsaQ:2.5.2 similarity = 0.889 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/install.jsView file

3const path = require('path'); L4: const { execSync } = require('child_process'); L5: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L3

bin/doc-fetch.jsView file

53console.error(' npm uninstall -g doc-fetch-cli'); L54: console.error(' npm install -g doc-fetch-cli@latest'); L55: process.exit(1); ... L60: // Spawn the Go binary L61: const child = spawn(binaryPath, args, { L62: stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/doc-fetch.jsView on unpkg · L53

doc-fetch_linux_amd64View file

•path = doc-fetch_linux_amd64 kind = native_binary sizeBytes = 9168802 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

doc-fetch_linux_amd64View on unpkg

bin/postinstall.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.jsView on unpkg

Findings

1 Critical4 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltabin/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/install.js

HighShell

HighRuntime Package Installbin/doc-fetch.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumShips Native Binarydoc-fetch_linux_amd64

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 1-29json

2 "name": "doc-fetch-cli",

3 "version": "2.5.6",

4 "description": "Dynamic documentation fetching CLI that converts entire documentation sites to single markdown files for AI/LLM consumption",

5 "bin": {

6 "doc-fetch": "./bin/doc-fetch.js"

7 },

8 "scripts": {

9 "prepublishOnly": "node ./scripts/verify-binaries.js",

10 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "verify": "node ./scripts/verify-binaries.js"

12 },

13 "repository": {

14 "type": "git",

15 "url": "https://github.com/AlphaTechini/doc-fetch.git"

16 },

17 "homepage": "https://doc-fetch.vercel.app/",

18 "keywords": [

19 "documentation",

20 "ai",

21 "llm",

22 "markdown",

23 "crawler",

24 "security"

25 ],

26 "author": "AlphaTechini",

27 "license": "MIT"

28}

bin/install.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2const os = require('os');

3const path = require('path');

4const { execSync } = require('child_process');

5const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L3

6const https = require('https');

7const { pipeline } = require('stream');

8const { promisify } = require('util');

10const finished = promisify(pipeline);

12// Security: Validate and sanitize output paths

13function validateOutputPath(filePath) {

14 // Resolve to absolute path

15 const absPath = path.resolve(filePath);

17 // Get current working directory

18 const cwd = process.cwd();

20 // Ensure the path is within the current directory or a subdirectory

21 if (!absPath.startsWith(cwd)) {

22 throw new Error('Output path must be within current directory or subdirectories');

23 }

bin/doc-fetch.jsView file

Lines 33-73javascript

33 'doc-fetch_linux_amd64',

34 'doc-fetch_linux_arm64',

35];

37let binaryPath = null;

38for (const name of possibleBinaries) {

39 const testPath = path.join(packageDir, name);

40 if (fs.existsSync(testPath)) {

41 binaryPath = testPath;

42 break;

43 }

44}

46if (!binaryPath) {

47 console.error('❌ doc-fetch binary not found!');

48 console.error('');

49 console.error('💡 Platform:', platform, '(' + process.arch + ')');

50 console.error('💡 Searched in:', packageDir);

51 console.error('');

52 console.error('💡 Try reinstalling:');

53 console.error(' npm uninstall -g doc-fetch-cli');

54 console.error(' npm install -g doc-fetch-cli@latest');

55 process.exit(1);

56}

58const args = process.argv.slice(2);

60// Spawn the Go binary

61const child = spawn(binaryPath, args, {

62 stdio: 'inherit'

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/doc-fetch.jsView on unpkg · L53

63});

65child.on('error', (err) => {

66 if (err.code === 'ENOENT') {

67 console.error('❌ Failed to execute binary');

68 console.error(' Path:', binaryPath);

69 console.error(' Error: File not found or no execute permission');

70 if (platform !== 'win32') {

71 console.error('');

72 console.error('💡 Fix permissions: chmod +x "' + binaryPath + '"');

73 }

doc-fetch_linux_amd64View file

•path = doc-fetch_linux_amd64 kind = native_binary sizeBytes = 9168802 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

doc-fetch_linux_amd64View on unpkg

bin/postinstall.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/postinstall.jsView on unpkg