registry / muhiyacode / 1.0.2

muhiyacode@1.0.2

MuhiyaCode — an interactive terminal coding agent.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Install-time code fetches an opaque native release archive and writes it under this package's `vendor/` directory. The wrapper later executes that binary with user-supplied CLI arguments. No confirmed credential theft, destructive behavior, or foreign AI-agent control-surface mutation appears in the inspected source.

Static reason

One or more suspicious static signals were detected.

Trigger

`npm install` runs postinstall; invoking `muhiyacode` launches the fetched binary.

Impact

A compromised or replaced release asset could execute arbitrary native code when the CLI is run.

Mechanism

Unverified install-time native binary download, extraction, and later execution.

Rationale

The inspected source establishes a real unverified remote-native-payload execution path, but does not establish malicious intent or a concrete harmful action in the package JavaScript. This warrants a warning rather than a block.

Evidence

package.jsonscripts/npm-postinstall.jsbin/muhiyacode.jsREADME.mdvendor/

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

muhiyacode@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code