onveloz@0.0.0-beta.43
CLI da plataforma Veloz — deploy rápido para o Brasil
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports a warning for first-party agent extension setup and its unpinned execution lifecycle. The scanner's credential-redirection claim was not substantiated, and no block-eligible attack behavior was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Accepting interactive agent setup, using the configured MCP integration, or invoking init from an AI-agent environment outside CI.
Impact
Agent sessions can execute a subsequently published CLI release, and agent-invoked init can add package-owned project skills. This warrants a capability warning, not a malware block.
Mechanism
Setup invokes the CLI's MCP and skill commands; the MCP command resolves onveloz through npx without a version pin.
AI rationale
Inspected source supports a warning for first-party agent extension setup and its unpinned execution lifecycle. The scanner's credential-redirection claim was not substantiated, and no block-eligible attack behavior was established.
Evidence
dist/index.mjs.claude/skills/
Network endpoints1
platform.onveloz.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest has no registry-install lifecycle hook or runtime self-dependency.
- The interactive setup waits for the user's choice and permits declining agent integration.
- The deployment helper runs a fixed Git command to identify the branch.
- The MCP registration command uses npx to run onveloz without pinning a version, allowing later sessions to resolve newer releases.
- When an AI agent invokes init outside CI, the CLI automatically requests project-local skill installation.
- The default authentication endpoint is platform.onveloz.com, rather than an unrelated credential gateway.
Evidence against
- No concrete malware, covert credential export, or install-time agent configuration mutation was established.
- Agent setup is tied to explicit CLI use; the interactive flow includes consent.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
5 flaggeddist/deploy-stream-RlGLmnU4.mjsView file
7import chalk from "chalk";
L8: import { execSync } from "node:child_process";
L9:
High
Child Process
Package source references child process execution.
dist/deploy-stream-RlGLmnU4.mjsView on unpkg · L7dist/index.mjsView file
10211//#region src/lib/auto-update.ts
L10212: const execAsync = promisify(exec);
L10213: const PACKAGE_NAME = "onveloz";
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.mjs:
import { appendFileSync, constants, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
import * as readline from "node:readline";
import { chmod, copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rm, writeFile } from "node:fs/promises";
".claude",
yield* io(() => writeFile(destination, file.content, {
"Treat credentials, API keys, and environment variables as secrets and never expose them unnecessarily.",
writeFileSync(CACHE_FILE, JSON.stringify(cache, null, 2), "utf-8");
writeFileSync(STATE_FILE, JSON.stringify(state
Findings
4 High2 Medium6 Low
HighChild Processdist/deploy-stream-RlGLmnU4.mjs
HighShelldist/index.mjs
HighCredential Redirect Persistencedist/index.mjs
HighCross File Remote Execution Contextdist/index.mjs
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/config-DbVqGVaI.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to onveloz@0.0.0-beta.43.
See all versions of onveloz for other recorded verdicts.
- Review the evidence and your use of onveloz@0.0.0-beta.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.