registry / nur-cli / 0.41.0

nur-cli@0.41.0

NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed attack was identified. The package is a transparent native-binary installer using its own GitHub releases.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall or explicit CLI invocation activates native installation.

Impact

Package-aligned software installation occurs; the inspected source establishes no malicious effect, although downloaded binary behavior is outside this snapshot.

Mechanism

The shim downloads a platform-specific binary, writes it into the installation directory, sets executable permissions where applicable, and runs its install command.

AI rationale

The inspected lifecycle and CLI behavior implement a straightforward installer for the package's own native releases. Remote binary execution alone does not establish malicious intent or a concrete attack in this source.

Evidence

~/.local/bin

Network endpoints1

github.com/nuroctane/nur-cli/releases

Decision evidence

public snapshot

AI called this Clean at 88.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

nur-cli@0.41.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code