registry  /  lazycf  /  0.1.1

lazycf@0.1.1

TUI lazy para gestionar la infraestructura de Cloudflare desde la terminal

AI Security Review

scanned 6d ago · by lpm-firewall-ai

The package uses an install-time downloader for a native LazyCF binary. This creates unresolved supply-chain risk but no confirmed malicious behavior in the inspected source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install/postinstall, then user running lazycf
Impact
Downloaded release binary can execute with user privileges when lazycf is invoked; source package does not reveal the binary contents.
Mechanism
install-time remote executable download and CLI shim execution
Attack narrative
On install, lazycf selects an OS/architecture-specific GitHub release asset, downloads it, writes it under the package bin directory, and makes it executable. The published npm source only contains a shim that later spawns that downloaded binary. This is package-aligned but leaves the executable payload outside npm source review and without integrity verification.
Rationale
Static inspection shows a package-aligned native binary downloader with no direct exfiltration or persistence, so publish blocking as malware is not justified. The install-time unsigned executable fetch is a real unresolved risk and should be warned rather than marked clean.
Evidence
package.jsoninstall.jsbin/lazycfbin/lazycf-binbin/lazycf-bin.exe
Network endpoints1
github.com/PaulPPS632/lazycf/releases/download/v${VERSION}/${assetName}

Decision evidence

public snapshot
AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node install.js.
  • install.js downloads a platform-specific executable from GitHub releases during install.
  • install.js writes downloaded bytes to bin/lazycf-bin or bin/lazycf-bin.exe and chmods executable.
  • No checksum, signature verification, or pinned integrity is present before executing later via CLI shim.
Evidence against
  • Download host is package-aligned with declared repository PaulPPS632/lazycf.
  • bin/lazycf only spawns the downloaded package-local binary when the user runs the CLI.
  • No credential harvesting, broad filesystem scanning, persistence, destructive behavior, or AI-agent control-surface writes found.
  • Network use is limited to the GitHub release asset URL constructed from package name/version/platform.
Behavioral surface
Source
EnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
Manifest
CopyleftLicense
scanned 1 file(s), 2.93 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings
LowCopyleft License