registry / naabigacode / 0.1.3

naabigacode@0.1.3

NaabigaCode — agentic coding en terminal (TUI style Claude Code + backend Python). Installation one-shot : backend auto-installé dans ~/.naabiga.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

On npm installation, the package fetches backend code absent from the published tarball and installs its Python dependencies. The fetched content is not integrity-pinned by a hash or signature in the inspected source.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

A future or compromised tagged archive or its dependency resolution can introduce code outside the reviewed npm artifact.

Mechanism

remote backend download, extraction, and pip dependency installation

Rationale

This is a concrete install-time staged payload carrier, but the inspected package itself contains no direct theft, destructive behavior, or foreign AI-agent control-surface mutation. Warn rather than block.

Evidence

package.jsonscripts/install-backend.mjscli.mjsREADME.md~/.naabiga/backend~/.naabiga/backend/.venv

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

naabigacode@0.1.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code