droid@0.225.1
Factory Droid CLI - AI-powered software engineering agent
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe lifecycle behavior is limited to obtaining the package's platform binary and optimizing its own command shim. The inspected credential handling is restricted to npmjs.org requests, with no concrete malicious behavior found.
Decision evidence
public snapshot- The package declares a postinstall hook that runs its local installer.
- The installer obtains fallback platform artifacts through the npm registry.
- The installer changes only its own command shim to point at the selected binary.
- An npm token is conditionally attached only for npmjs.org requests.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
Findings
Affected versions and remediation
This report applies to droid@0.225.1.
See all versions of droid for other recorded verdicts.
- Review the evidence and your use of droid@0.225.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.