registry / Remote code execution / superacli / 1.32.0

superacli@1.32.0

10,000+ tools. One CLI. Zero configuration.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package is not shown to be malicious at installation, but it contains a concrete fail-open authentication path to user-controlled server-side code execution. This warrants a warning for a critical vulnerability.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Start or import the server, then submit and execute an adapter through its API while authentication fails open.

Impact

An unauthenticated requester may achieve server-side code execution if the server is reachable and settings access fails.

Mechanism

User-supplied adapter code runs in a Node VM with all built-ins enabled.

AI rationale

Evidence

package.jsonserver/app.jsserver/middleware/auth.jsserver/routes/adapters.jssupercli_storage/adapters/<name>/

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

Its postinstall hook automatically invokes the CLI, although the referenced bundled plugin is absent.
The server exposes adapter creation and execution endpoints.
Authentication fails open if settings retrieval throws.
Adapter source is executed with all Node built-ins enabled, allowing supplied code to run.

Evidence against

The postinstall target is a missing local path and errors are explicitly ignored.
AI-harness files are written only by the explicit onboard command.
There is no runtime dependency on this package name and no install-time network fetch.
No credential harvesting or unsolicited external exfiltration was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 81 file(s), 501 KB of source, external domains: 127.0.0.1, api.browser-use.com, api.github.com, astral.sh, github.com, install.python-poetry.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-27json

2 "name": "superacli",

3 "version": "1.32.0",

4 "description": "10,000+ tools. One CLI. Zero configuration.",

5 "license": "MIT",

6 "main": "server/app.js",

7 "bin": {

8 "dcli": "./cli/supercli.js",

9 "scli": "./cli/supercli.js",

10 "superacli": "./cli/supercli.js",

11 "supercli": "./cli/supercli.js",

12 "sc": "./cli/supercli.js"

13 },

14 "scripts": {

15 "start": "node cli/supercli.js",

16 "test": "jest",

17 "postinstall": "node cli/supercli.js plugins install ./plugins/supercli-mastery --on-conflict replace --json 2>/dev/null || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "install:skills": "node cli/supercli.js skills sync",

19 "release:patch": "npm version patch && git push --follow-tags && npm publish",

20 "release:minor": "npm version minor && git push --follow-tags && npm publish",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L18

21 "release:major": "npm version major && git push --follow-tags && npm publish"

22 },

23 "engines": {

24 "node": ">=18.0.0"

25 }

26}

server/services/adaptersService.jsView file

Lines 142-208javascript

142}

143

144async function deleteAdapter(name) {

145 const storage = getStorage()

146 const key

cli/supercli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

3"use strict";

5require("dotenv").config({ quiet: true });

6const { loadConfig, syncConfig, showConfig, setMcpServer, removeMcpServer

cli/harness-onboard.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. "use strict"; const fs = require("fs"); const path = require("path"); const { compileforharness, getallharnesses, harness_configs } = require("../skills/supercli/compile"); function invalid(message) { return object.assign(new error(message), { code: 85, type: "invalid_argument", recoverable: false, }); } function detectharnesses(targetdir = process.cwd()) { const detected = []; const checks = [ { name: "claude", patterns: [".claude"] }, { name: "opencode", patterns: [".opencode"] }, { name: "cursor", patterns: [".cursor"] }, { name: "windsurf", patterns: [".windsurfrules", ".windsurf"] }, ]; for (const check of checks) { for (const

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/harness-onboard.jsView on unpkg

supercli-machin-cli/install.shView file

•path = supercli-machin-cli/install.sh kind = build_helper sizeBytes = 3678 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

supercli-machin-cli/install.shView on unpkg

cli/ask.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli/ask.js#virtual:string-array:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/supercli.js plugins install ./plugins/supercli-mastery --on-conflict replace --json 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

18scripts.postinstall = node cli/supercli.js plugins install ./plugins/supercli-mastery --on-conflict replace --json 2>/dev/null || true Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L18: const { discoverPluginsByIntent } = require("./discover"); L19: const { startDaemon, stopDaemon, getDaemonStatus, writeLog } = require("./daemon"); L20: const { buildCapabilities } = require("./help-json"); ... L69: if (passthrough) { L70: const start = Date.now(); L71: const { execute } = require("./executor"); ... L76: }); L77: const envelope = { version: "1.0", command: `${passthrough.namespace}.passthrough`, duration_ms: Date.now() - start, data: result }; L78: if (humanMode && result && typeof resul

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L18

•scripts.postinstall = node cli/supercli.js plugins install ./plugins/supercli-mastery --on-conflict replace --json 2>/dev/null || true

Findings

1 Critical6 High5 Medium4 Low

CriticalAi Agent Control Hijackcli/supercli.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processserver/services/adaptersService.js

HighUnverified Remote Native Payload Installpackage.json

HighTrigger Reachable External Ai Agent Control Surface Mutationcli/harness-onboard.js

HighRuntime Package Installserver/services/adaptersService.js

HighSemantic Analysis Limitedcli/ask.js#virtual:string-array:round1

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpersupercli-machin-cli/install.sh

Medium

Affected versions and remediation

This report applies to superacli@1.32.0.

See all versions of superacli for other recorded verdicts.

Review the evidence and your use of superacli@1.32.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 22:18:02.885Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.