registry / Credential exfiltration / perchai-cli

perchai-cli

Perch AI command-line interface

This report shows the evidence for perchai-cli@2.4.92. 1 of 31 known versions is blocked or flagged. The newest version, 2.4.114, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes a concrete credential-harvesting and remote-authentication chain, not merely support for user-provided environment keys. Although execution is CLI-invoked and there is no install hook, the cross-tool credential capture and fixed proxy redirection are malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Run perch after selecting or persisting a Grok Build model.

Impact

Credential theft and unauthorized use of a Grok account token.

Mechanism

Harvests ~/.grok/auth.json and redirects its token to a third-party model proxy.

Attack narrative

The manifest exposes the perch executable. Its runtime initializes persisted model selection; for Grok selections it reads ~/.grok/auth.json, stores the discovered key as a Grok provider override, and performs authenticated requests to cli-chat-proxy.grok.com/v1. This redirects a credential belonging to another installed tool/service to a package-selected proxy.

AI rationale

Evidence

package.jsonbin/perchdist/perch.mjs~/.grok/auth.json

Network endpoints1

cli-chat-proxy.grok.com/v1

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI reads a Grok credential from ~/.grok/auth.json.
A selected Grok model installs that credential as an override.
Grok requests use the extracted token as a Bearer credential.
The default Grok endpoint is cli-chat-proxy.grok.com, not an xAI API host.
Persisted model selection is applied when the CLI starts.

Evidence against

No npm lifecycle scripts are declared.
The bundle is reached through the user-invoked perch binary.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 0 file(s), 256 KB of source, external domains: api.example.com, app.perchai.app

Oversized source lightweight scan

dist/perch.mjs

Source & flagged code

12 flagged

dist/perch.mjsView file

4var eDt=Object.create;var IW=Object.defineProperty;var tDt=Object.getOwnPropertyDescriptor;var rDt=Object.getOwnPropertyNames;var nDt=Object.getPrototypeOf,oDt=Object.prototype.has... L5: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE... L6: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC7\xFC\xE9\xE2\xE4\xE0\u0105\xE7\xEA\xEB\xE8\xEF\x... ... L35: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC4\xC5\xC7\xC9\xD1\xD6\xDC\xE1\xE0\xE2\xE4\xE3\xE5... L36: \v\f\r\x1B !"#$%&'()*

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/perch.mjsView on unpkg · L4

316Trigger-reachable chain: manifest.bin -> bin/perch -> dist/perch.mjs L316: `)} L317: `}function Gzt(e){let t=o6(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function n6(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var TO,FHe,HHe=ue(()=>{"use strict";TO=sa(RW()),FHe=sa(PHe())});async function Lue(e){let t=await OHe(e);return await qzt(t.html,t.pdf)||NHe(t.pdf,e),t}async function qzt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=iVt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function wde(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function _je(e){return`${e.from}|${e.to}|${e.type}`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/perch.mjsView on unpkg · L316

318`).trim()}var TO,FHe,HHe=ue(()=>{"use strict";TO=sa(RW()),FHe=sa(PHe())});async function Lue(e){let t=await OHe(e);return await qzt(t.html,t.pdf)||NHe(t.pdf,e),t}async function qzt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=iVt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function wde(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function _je(e){return`${e.from}|${e.to}|${e.type}`}function kje(e){return e?{low:1,me...

High

Child Process

Package source references child process execution.

dist/perch.mjsView on unpkg · L318

317`}function Gzt(e){let t=o6(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function n6(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var TO,FHe,HHe=ue(()=>{"use strict";TO=sa(RW()),FHe=sa(PHe())});async function Lue(e){let t=await OHe(e);return await qzt(t.html,t.pdf)||NHe(t.pdf,e),t}async function qzt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=iVt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... ... L326: `),r=!1;return t.map(n=>/^\s*```/.test(n)?(r=!r,n):r||/^\s*>/.test(n)?n:n$t(n)).join(` L327: `)}function n$t(e){let t="",r=!1,n=!1,o=!1;for(let i=0;i<e.length;i+=1){let a=e[i],s=i>0?e[i-1]:"";if(a==="`"){o=!o,t+=a;contin

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/perch.mjsView on unpkg · L317

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/perch.mjs: var eDt=Object.create;var IW=Object.defineProperty;var tDt=Object.getOwnPropertyDescriptor;var rDt=Object.getOwnPropertyNames;var nDt=Object.getPrototypeOf,oDt=Object.prototype.has... \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C... `)}function YRt(ft){var Nt={};return Ht(Nt,ft),Nt}function _ie(ft,Nt,Ct,It){var Ut=It&&It.unsafe;Ut||Ht(ft);var jt=!Ut&&Ro.find(ft,Nt);if(!jt){var jr=ft.FullPaths[0];Nt.slice(0,jr.... `),U.bookType=="fods"?ce.push("</office:document>"):ce.push("</office:docum

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/perch.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/perch.mjs: var eDt=Object.create;var IW=Object.defineProperty;var tDt=Object.getOwnPropertyDescriptor;var rDt=Object.getOwnPropertyNames;var nDt=Object.getPrototypeOf,oDt=Object.prototype.has... \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C... `)}function YRt(ft){var Nt={};return Ht(Nt,ft),Nt}function _ie(ft,Nt,Ct,It){var Ut=It&&It.unsafe;Ut||Ht(ft);var jt=!Ut&&Ro.find(ft,Nt);if(!jt){var jr=ft.FullPaths[0];Nt.slice(0,jr.... `),U.bookType=="fods"?ce.push("</office:document>"):ce.push("</office:document-content>"),ce.joi

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/perch.mjsView on unpkg

316`)} L317: `}function Gzt(e){let t=o6(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function n6(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var TO,FHe,HHe=ue(()=>{"use strict";TO=sa(RW()),FHe=sa(PHe())});async function Lue(e){let t=await OHe(e);return await qzt(t.html,t.pdf)||NHe(t.pdf,e),t}async function qzt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=iVt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function wde(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function _je(e){return`${e.from}|${e.to}|${e.type}`}function kje(e){return e?{low:1,me... ... L326: `),r=!1;return t.map

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/perch.mjsView on unpkg · L316

35\v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC4\xC5\xC7\xC9\xD1\xD6\xDC\xE1\xE0\xE2\xE4\xE3\xE5... L36: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C... L37: `)+`\r ... L318: `).trim()}var TO,FHe,HHe=ue(()=>{"use strict";TO=sa(RW()),FHe=sa(PHe())});async function Lue(e){let t=await OHe(e);return await qzt(t.html,t.pdf)||NHe(t.pdf,e),t}async function qzt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=iVt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function w

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/perch.mjsView on unpkg · L35

316Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/perch -> dist/perch.mjs L316: `)} L317: `}function Gzt(e){let t=o6(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function n6(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var TO,FHe,HHe=ue(()=>{"use strict";TO=sa(RW()),FHe=sa(PHe())});async function Lue(e){let t=await OHe(e);return await qzt(t.html,t.pdf)||NHe(t.pdf,e),t}async function qzt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=iVt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function wde(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function _je(e){return`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/perch.mjsView on unpkg · L316

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/perch.mjsView on unpkg

•path = dist/perch.mjs kind = oversized_source_file sizeBytes = 7574178 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/perch.mjsView on unpkg

•path = dist/perch.mjs kind = oversized_cli_entrypoint sizeBytes = 7574178 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/perch.mjsView on unpkg

Source & flagged code

12 flagged · loading source

dist/perch.mjsView file

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/perch.mjsView on unpkg · L4

Findings

2 Critical8 High5 Medium4 Low

CriticalClipboard Crypto Hijackdist/perch.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/perch.mjs

HighChild Processdist/perch.mjs

HighSame File Env Network Executiondist/perch.mjs

HighCredential Redirect Persistencedist/perch.mjs

HighEntrypoint Foreign Package Code Overwritedist/perch.mjs

HighCommand Output Exfiltrationdist/perch.mjs

HighRemote Agent Bridgedist/perch.mjs

HighTrigger Reachable Command Output Exfiltrationdist/perch.mjs

HighSemantic Analysis Limiteddist/perch.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to perchai-cli@2.4.92.

The versions list below shows the verdict for each recorded version.

Avoid installing perchai-cli@2.4.92. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 00:24:38.144Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

31 known versions

2.4.114latestUnknown—AllowUnder ReviewOct 23, 2026, 1:08 AM 2.4.113Unknown—AllowUnder ReviewOct 21, 2026, 4:06 AM 2.4.111Unknown—AllowUnder ReviewOct 19, 2026, 12:37 AM 2.4.110Unknown—AllowUnder ReviewOct 17, 2026, 9:43 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Related packages

Other credential exfiltration packages

Source & flagged code