registry / perchai-cli / 2.4.88

perchai-cli@2.4.88

Perch AI command-line interface

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The user-invoked CLI supports networked AI providers and local agent operations, including a selectable Modal endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit `perch` CLI and BYOK/provider commands.

Impact

No unconsented install-time execution, credential harvesting, or exfiltration confirmed.

Mechanism

User-directed AI CLI with configurable provider endpoints.

Rationale

Direct inspection found no lifecycle hook or automatic malicious chain. The unusual Modal endpoint is selectable provider configuration, so source does not establish unconsented credential redirection or payload execution.

Evidence

package.jsonbin/perchdist/perch.mjsREADME.md

Network endpoints1

hmehmood56-debug--perch-minimax-m27-llama-serve.modal.run/v1

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

Selectable modal provider defaults to a developer-specific modal.run inference endpoint.

Evidence against

package.json has no lifecycle scripts.
bin/perch only dynamically imports the bundled CLI when the user invokes `perch`.
Credential setup is exposed as explicit `perch byok set ... --key` user commands; no automatic credential collection or upload was confirmed.
Clipboard code is for explicit browser document-paste automation, not wallet-address replacement.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 0 file(s), 256 KB of source, external domains: api.example.com, app.perchai.app

Oversized source lightweight scan

Source & flagged code

12 flagged

dist/perch.mjsView file

4var W2t=Object.create;var yW=Object.defineProperty;var q2t=Object.getOwnPropertyDescriptor;var z2t=Object.getOwnPropertyNames;var V2t=Object.getPrototypeOf,K2t=Object.prototype.has... L5: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC7\xFC\xE9\xE2\xE4\xE0\xE5\xE7\xEA\xEB\xE8\xEF\xEE... L6: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC7\xFC\xE9\xE2\xE4\xE0\u0105\xE7\xEA\xEB\xE8\xEF\x... ... L35: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC4\xC5\xC7\xC9\xD1\xD6\xDC\xE1\xE0\xE2\xE4\xE3\xE5... L36: \v\f\r\x1B !"#$%&'()*

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/perch.mjsView on unpkg · L4

316Trigger-reachable chain: manifest.bin -> bin/perch -> dist/perch.mjs L316: `)} L317: `}function Pqt(e){let t=X8(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function Y8(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var yO,lHe,hHe=ue(()=>{"use strict";yO=Ji(bW()),lHe=Ji(aHe())});async function wue(e){let t=await cHe(e);return await Fqt(t.html,t.pdf)||uHe(t.pdf,e),t}async function Fqt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=$qt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function ode(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function $He(e){return`${e.from}|${e.to}|${e.type}`

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/perch.mjsView on unpkg · L316

318`).trim()}var yO,lHe,hHe=ue(()=>{"use strict";yO=Ji(bW()),lHe=Ji(aHe())});async function wue(e){let t=await cHe(e);return await Fqt(t.html,t.pdf)||uHe(t.pdf,e),t}async function Fqt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=$qt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function ode(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function $He(e){return`${e.from}|${e.to}|${e.type}`}function YHe(e){return e?{low:1,me...

High

Child Process

Package source references child process execution.

dist/perch.mjsView on unpkg · L318

317`}function Pqt(e){let t=X8(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function Y8(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var yO,lHe,hHe=ue(()=>{"use strict";yO=Ji(bW()),lHe=Ji(aHe())});async function wue(e){let t=await cHe(e);return await Fqt(t.html,t.pdf)||uHe(t.pdf,e),t}async function Fqt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=$qt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... ... L326: `),r=!1;return t.map(n=>/^\s*```/.test(n)?(r=!r,n):r||/^\s*>/.test(n)?n:zVt(n)).join(` L327: `)}function zVt(e){let t="",r=!1,n=!1,o=!1;for(let i=0;i<e.length;i+=1){let a=e[i],s=i>0?e[i-1]:"";if(a==="`"){o=!o,t+=a;contin

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/perch.mjsView on unpkg · L317

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/perch.mjs: var W2t=Object.create;var yW=Object.defineProperty;var q2t=Object.getOwnPropertyDescriptor;var z2t=Object.getOwnPropertyNames;var V2t=Object.getPrototypeOf,K2t=Object.prototype.has... \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C... `)}function Q2t(ft){var Nt={};return Qt(Nt,ft),Nt}function iie(ft,Nt,xt,Tt){var Ut=Tt&&Tt.unsafe;Ut||Qt(ft);var Ht=!Ut&&Eo.find(ft,Nt);if(!Ht){var Gr=ft.FullPaths[0];Nt.slice(0,Gr.... `),U.bookType=="fods"?ce.push("</office:document>"):ce.push("</office:docum

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/perch.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/perch.mjs: var W2t=Object.create;var yW=Object.defineProperty;var q2t=Object.getOwnPropertyDescriptor;var z2t=Object.getOwnPropertyNames;var V2t=Object.getPrototypeOf,K2t=Object.prototype.has... \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C... `)}function Q2t(ft){var Nt={};return Qt(Nt,ft),Nt}function iie(ft,Nt,xt,Tt){var Ut=Tt&&Tt.unsafe;Ut||Qt(ft);var Ht=!Ut&&Eo.find(ft,Nt);if(!Ht){var Gr=ft.FullPaths[0];Nt.slice(0,Gr.... `),U.bookType=="fods"?ce.push("</office:document>"):ce.push("</office:document-content>"),ce.joi

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/perch.mjsView on unpkg

316`)} L317: `}function Pqt(e){let t=X8(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function Y8(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var yO,lHe,hHe=ue(()=>{"use strict";yO=Ji(bW()),lHe=Ji(aHe())});async function wue(e){let t=await cHe(e);return await Fqt(t.html,t.pdf)||uHe(t.pdf,e),t}async function Fqt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=$qt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function ode(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function $He(e){return`${e.from}|${e.to}|${e.type}`}function YHe(e){return e?{low:1,me... ... L326: `),r=!1;return t.map

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/perch.mjsView on unpkg · L316

35\v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\xC4\xC5\xC7\xC9\xD1\xD6\xDC\xE1\xE0\xE2\xE4\xE3\xE5... L36: \v\f\r\x1B !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_\`abcdefghijklmnopqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C... L37: `)+`\r ... L318: `).trim()}var yO,lHe,hHe=ue(()=>{"use strict";yO=Ji(bW()),lHe=Ji(aHe())});async function wue(e){let t=await cHe(e);return await Fqt(t.html,t.pdf)||uHe(t.pdf,e),t}async function Fqt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=$qt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function o

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/perch.mjsView on unpkg · L35

316Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/perch -> dist/perch.mjs L316: `)} L317: `}function Pqt(e){let t=X8(String(e??""));return/[",\n]/.test(t)?`"${t.replace(/"/g,'""')}"`:t}function Y8(e){return new Intl.NumberFormat("en-US",{style:"currency",currency:"USD",... L318: `).trim()}var yO,lHe,hHe=ue(()=>{"use strict";yO=Ji(bW()),lHe=Ji(aHe())});async function wue(e){let t=await cHe(e);return await Fqt(t.html,t.pdf)||uHe(t.pdf,e),t}async function Fqt... L319: `).trim();if(!r)return{rows:[]};let n=t.find(i=>i.text.trim())??t[0],o=$qt({fileName:e.fileName,role:e.role,text:r,firstPageText:n?.text??r,pageNumber:n?.pageNumber,pageTotal:n?.pa... L320: `,"utf8")}function ode(e,t){return!Number.isFinite(e)||!e||e<=0?t:Math.min(500,Math.floor(e))}function $He(e){return`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/perch.mjsView on unpkg · L316

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/perch.mjsView on unpkg

•path = dist/perch.mjs kind = oversized_source_file sizeBytes = 7536683 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/perch.mjsView on unpkg

•path = dist/perch.mjs kind = oversized_cli_entrypoint sizeBytes = 7536683 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/perch.mjsView on unpkg

Source & flagged code

12 flagged · loading source

dist/perch.mjsView file

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

dist/perch.mjsView on unpkg · L4

Findings

2 Critical8 High5 Medium4 Low

CriticalClipboard Crypto Hijackdist/perch.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/perch.mjs

HighChild Processdist/perch.mjs

HighSame File Env Network Executiondist/perch.mjs

HighCredential Redirect Persistencedist/perch.mjs

HighEntrypoint Foreign Package Code Overwritedist/perch.mjs

HighCommand Output Exfiltrationdist/perch.mjs

HighRemote Agent Bridgedist/perch.mjs

HighTrigger Reachable Command Output Exfiltrationdist/perch.mjs

HighSemantic Analysis Limiteddist/perch.mjs

MediumNetwork

MediumEnvironment Vars