registry / naabigacode / 0.1.2

naabigacode@0.1.2

NaabigaCode — agentic coding en terminal (TUI style Claude Code + backend Python). Installation one-shot : backend auto-installé dans ~/.naabiga.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

npm installation runs a script that fetches an omitted Python backend and installs its dependencies. No confirmed malicious behavior is present in the inspected npm payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Remote code and dependencies become installed under the user's Naabiga directory during package installation.

Mechanism

remote backend download, extraction, and pip dependency installation

Rationale

The package creates a material install-time remote-code supply-chain risk, but inspected source does not establish malicious intent or a concrete malicious chain. Warn rather than block.

Evidence

package.jsonscripts/install-backend.mjscli.mjsREADME.md~/.naabiga/backend~/.naabiga/backend/.venv

Network endpoints1

github.com/n8nprobf-hub/NaabigaCode/archive/refs/tags/v0.3.0.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

naabigacode@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code