registry / nur-cli / 0.29.3

nur-cli@0.29.3

NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

npm postinstall downloads a current GitHub Release binary, saves it in the user's local bin directory, then executes its install command. The payload is remote and unverified by this package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall when no existing nur binary is found; CLI invocation always downloads and runs it.

Impact

A compromised or changed release can execute native code and perform the binary's broader installer actions.

Mechanism

unverified remote binary download and execution

AI rationale

This is a documented same-vendor CLI bootstrapper rather than evidence of stealthy malware, but it performs unverified remote native-code execution during npm postinstall. The risk warrants a warning rather than a block under the stated lifecycle policy.

Evidence

package.jsonbin.jsREADME.md~/.local/bin/nur%USERPROFILE%\.local\bin\nur.exe

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

nur-cli@0.29.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code