registry / naabigacode / 0.1.6

naabigacode@0.1.6

NaabigaCode — agentic coding en terminal (TUI style Claude Code + backend Python). Installation one-shot : backend auto-installé dans ~/.naabiga.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Install-time remote backend bootstrap creates a staged payload path. No concrete malicious behavior is present in the inspected package source.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall when backend/main.py is absent

Impact

Remote unreviewed backend and its dependencies execute installation logic outside the npm tarball.

Mechanism

downloads, extracts, copies, and pip-installs a remote backend

Rationale

The package has a concrete unverified install-time remote-payload chain, but the inspected source does not show malicious intent, exfiltration, destructive behavior, or broad AI-agent control-surface mutation.

Evidence

package.jsonscripts/install-backend.mjscli.mjsREADME.md~/.naabiga/backend~/.naabiga/backend/.venv

Network endpoints1

github.com/n8nprobf-hub/NaabigaCode/archive/refs/tags/v0.3.0.tar.gz

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Unknown with low false-positive risk.

naabigacode@0.1.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code