encrata-cli@0.12.0

Encrata CLI — intelligence lookups from your terminal

AI Security Review

scanned 20d ago · by lpm-firewall-ai

The inspected installer and launcher implement a package-aligned native CLI installation, with no concrete malicious behavior or lifecycle self-dependency. Missing artifact verification limits assurance but does not establish an attack; the scanner's transport-verification claim is unsupported by the HTTPS implementation.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall downloads and extracts the executable; invoking encrata runs it.

Impact

The inspected source installs and runs the CLI without observed credential harvesting, foreign agent configuration writes, or malicious persistence. The downloaded executable cannot be assessed from this snapshot.

Mechanism

HTTPS download, archive extraction, package-local executable installation, and argument forwarding implement the CLI distribution workflow.

AI rationale

Evidence

bin/encrata-binbin/encrata-bin.exebin/.extract

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json runs install.js after installation and declares no runtime dependencies.
install.js downloads a versioned platform archive from the Encratahq/encrata-cli GitHub releases using HTTPS.
The installer follows HTTP redirects through HTTPS requests; it does not disable TLS verification.
The installer copies the executable into its package directory and removes extraction files.
bin/encrata executes the installed binary when the user invokes the CLI, forwarding command arguments.

Evidence against

Downloaded archives lack checksum or signature verification, and the remote executable's behavior is outside this snapshot.

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 3.21 KB of source, external domains: github.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-28json

2 "name": "encrata-cli",

3 "version": "0.12.0",

4 "description": "Encrata CLI — intelligence lookups from your terminal",

5 "bin": {

6 "encrata": "bin/encrata"

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

7 },

8 "keywords": ["encrata", "osint", "email-lookup", "phone-lookup", "domain-lookup", "ip-lookup", "darkweb", "web-scraping", "screenshot", "face-recognition", "intelligence", "cli"],

9 "author": "Encrata <hello@encrata.com>",

10 "license": "MIT",

11 "homepage": "https://encrata.com",

12 "repository": {

13 "type": "git",

14 "url": "git+https://github.com/Encratahq/encrata-cli.git"

15 },

16 "engines": {

17 "node": ">=14"

18 },

19 "scripts": {

20 "postinstall": "node install.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 },

22 "files": [

23 "bin/",

24 "install.js",

25 "README.md"

26 ]

27}

Low

Suspicious Dependency Evidence

package.json runs install.js after installation and declares no runtime dependencies.

package.jsonView on unpkg · L19

install.jsView file

Lines 17-97javascript

17const ARCH_MAP = {

18 arm64: "arm64",

19 x64: "amd64",

20};

22const platform = PLATFORM_MAP[process.platform];

bin/encrataView file

Lines 1-29text

1#!/usr/bin/env node

3// Launcher shim. This file is committed and shipped in the npm package so that

4// npm always has a `bin` target to symlink onto PATH at install time (npm links

5// bins *before* postinstall runs). The actual platform binary is downloaded by

6// install.js into the same directory as `encrata-bin` and exec'd from here.

8const { spawnSync } = require("child_process");

9const { existsSync } = require("fs");

10const path = require("path");

12const binName = process.platform === "win32" ? "encrata-bin.exe" : "encrata-bin";

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

2scripts.postinstall = node install.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L2: L3: const { existsSync, mkdirSync, createWriteStream, chmodSync, unlinkSync, copyFileSync, rmSync } = require("fs"); L4: const path = require("path"); L5: const https = require("https"); L6: const { execSync } = require("child_process"); ... L30: L31: const ext = process.platform === "win32" ? ".zip" : ".tar.gz"; L32: // Name of the binary *inside* the GoReleaser archive. ... L37: const assetName = `encrata_${VERSION}_${platform}_${arch}${ext}`; L38: const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}`; L39: ... L52: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L2

•scripts.postinstall = node install.js

Medium

Findings

2 High2 Medium8 Low

HighInstall Time Lifecycle Scriptspackage.json

HighUnverified Remote Native Payload Installpackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

LowSuspicious Dependency Evidencepackage.json

LowAi Review Evidenceinstall.js

LowAi Review Evidencebin/encrata

Affected versions and remediation

This report applies to encrata-cli@0.12.0.

See all versions of encrata-cli for other recorded verdicts.

Review the evidence and your use of encrata-cli@0.12.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-05 06:40:32.007Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.