registry  /  miskin  /  0.1.3

miskin@0.1.3

Save AI tokens. Compress command output + caveman prompts. Single Rust binary.

AI Security Review

scanned 9h ago · by lpm-firewall-ai

Install-time script fetches a remote prebuilt binary from the package author's GitHub releases and installs it as the CLI. This creates unresolved remote binary risk, but the behavior is package-aligned and no concrete malicious logic is present in inspected source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall
Impact
Unverified downloaded executable becomes the miskin CLI on the user's PATH
Mechanism
postinstall remote binary downloader
Rationale
Source inspection confirms an install-time unverified binary download, which warrants a warning, but the endpoint and files are package-owned and no concrete malicious behavior appears in the package source. This is not enough for a publish block under the provided policy.
Evidence
package.jsoninstall.jsbin/miskinbin/miskin.exe
Network endpoints2
github.com/sonyarianto/miskin/releases/download/v0.1.3/<platform-binary>github.com/sonyarianto/miskin

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node install.js
  • install.js downloads a platform-specific executable during install
  • install.js writes bin/miskin or bin/miskin.exe and chmods it executable
  • downloaded release asset is not integrity-checked before becoming the package bin
Evidence against
  • Only package files are package.json and install.js
  • Network endpoint is package-aligned GitHub repository/release URL
  • No credential/env/home-directory harvesting found
  • No shell execution, eval/vm/Function, persistence, destructive behavior, or AI-agent config writes found
  • bin entry points only to the downloaded miskin binary
Behavioral surface
Source
FilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 2.28 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings