registry / nur-cli / 0.30.0

nur-cli@0.30.0

NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Install and the CLI entry both download an unsigned native binary from GitHub Releases and run it. There is no integrity check, latest is tried first, and redirects are not pinned to GitHub. The opaque nur install step can change the user environment beyond the npm package itself.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install runs postinstall (node bin.js --ensure); npx nur-cli or the bin entry runs the same downloader without --ensure.

Impact

Native code runs as the installing user and may change PATH and other local setup; a redirected or swapped release asset would also run.

Mechanism

postinstall remote binary download and execute

AI rationale

This is a first-party GitHub-release installer shim, not a hidden stealer, but postinstall still fetches and runs an unsigned latest binary with open redirects and then executes nur install. That is dangerous install-time capability and should warn, not pass clean or block as proven malware.

Evidence

package.jsonbin.js~/.local/bin/nur~/.local/bin/nur.exe

Network endpoints1

github.com/nuroctane/nur-cli/releases/

Decision evidence

public snapshot

nur-cli@0.30.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code