registry / nur-cli / 0.43.0

nur-cli@0.43.0

NurCLI - fully loaded multi-provider coding agent (TUI, vision, tools, sandbox, skills). One command installs the native binary: npx nur-cli

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed attack was identified. The source implements a native CLI installer using package-aligned GitHub releases.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall invokes ensure mode; invoking the CLI also downloads and installs the native binary.

Impact

The native CLI is installed and executed. The inspected source does not establish malicious behavior in that binary.

Mechanism

The shim downloads a platform asset, writes an executable, and runs its install command.

AI rationale

Direct inspection shows a transparent, package-aligned native installer without a concrete malicious chain. Scanner similarity labels do not establish an attack, and the unavailable native binary limits conclusions about downstream behavior.

Evidence

.local/bin/nur.local/bin/nur.exe

Network endpoints1

github.com/nuroctane/nur-cli/releases

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

nur-cli@0.43.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code