registry / muhiyacode / 1.0.6

muhiyacode@1.0.6

MuhiyaCode — an interactive terminal coding agent.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Install-time code downloads and extracts an opaque native payload without integrity verification. The CLI later executes that payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; invoking muhiyacode runs the installed binary.

Impact

A substituted release asset or redirect target can supply arbitrary native code.

Mechanism

Unverified remote native-binary staging and execution.

Rationale

The package is not proven malicious, but its automatic unverified remote-binary delivery creates a real unresolved supply-chain execution risk. Downgrade to a warning rather than block.

Evidence

package.jsonscripts/npm-postinstall.jsbin/muhiyacode.jsREADME.mdvendor/

Network endpoints1

github.com/muhiyatools/MuhiyaCode/releases/download/v${version}/${archiveName}

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

muhiyacode@1.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code