registry / naabigacode / 0.1.0

naabigacode@0.1.0

NaabigaCode — agentic coding en terminal (TUI style Claude Code + backend Python). Installation one-shot : backend auto-installé dans ~/.naabiga.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Installing the package fetches an unpinned remote backend and installs its Python dependencies. The fetched code is outside this tarball and cannot be source-reviewed here.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

A future change to the GitHub main branch or its dependency set can execute code during installation.

Mechanism

mutable remote payload download and dependency installation

Rationale

The package is a staged payload carrier: it automatically executes installation steps for mutable remote content. Its documented, package-scoped backend setup lowers evidence of malicious intent, but does not remove the unreviewable install-time execution risk.

Evidence

package.jsonscripts/install-backend.mjsREADME.mdcli.mjs~/.naabiga/backend

Network endpoints1

github.com/n8nprobf-hub/NaabigaCode/archive/refs/heads/main.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

naabigacode@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code