registry  /  tachograph  /  0.3.1

tachograph@0.3.1

A compact instrument cluster for your coding agents (Claude Code / Codex). Shows model, rate-limit usage, and context at a glance.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install fetches a version-scoped native archive and remotely supplied checksum, then extracts the platform binary. The CLI executes that binary only when the user runs `tacho`.

Static reason
One or more suspicious static signals were detected.
Trigger
`npm install` downloads and writes the binary; user invocation of `tacho` executes it.
Impact
A compromised or changed release asset can supply arbitrary native code for later user execution.
Mechanism
install-time remote native-binary bootstrap
Rationale
No concrete malicious behavior is present in the inspected source, but install-time acquisition of an unbundled native executable remains an unresolved remote-payload risk. Treat as a warning rather than a block.
Evidence
package.jsoninstall.jsasset.jsbin/tacho.jsbin/tachobin/tacho.exe
Network endpoints1
github.com

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • `package.json` runs `node install.js` in `postinstall`.
  • `install.js` downloads a platform archive at install time.
  • Checksum data is fetched from the same remote release, not embedded.
  • `install.js` extracts and drops a native executable in `bin/`.
  • `bin/tacho.js` later executes the downloaded executable.
Evidence against
  • Downloads are version-scoped GitHub release assets for this package.
  • No credential, token, home-directory, or agent-config harvesting found.
  • No downloaded binary is executed during `postinstall`.
  • No eval, shell interpolation, persistence, or destructive actions found.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 6.93 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowUrl Strings