droid@0.244.0
Factory Droid CLI - AI-powered software engineering agent
AI Security Review
scanned 19d ago · by lpm-firewall-aiThe lifecycle hook downloads only the matching platform package at this release’s version when its optional dependency is missing, then installs the expected binary beside the CLI. This is consistent with the package’s declared native CLI distribution, with no concrete attack behavior established by the inspected source.
Decision evidence
public snapshot- The manifest runs a postinstall installer and pins platform-specific @factory CLI optional dependencies to this version.
- The fallback runs only when the platform binary optional dependency is unavailable.
- The fallback selects the platform package at this package’s version and gets its tarball URL from registry.npmjs.org metadata.
- The installer extracts the expected platform binary and writes it into this package’s bin directory.
- The CLI shim runs the selected platform binary with the caller’s command-line arguments.
Source & flagged code
7 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L9Install-time lifecycle script is not statically allowlisted and needs review.
Findings
Affected versions and remediation
This report applies to droid@0.244.0.
See all versions of droid for other recorded verdicts.
- Review the evidence and your use of droid@0.244.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.