registry / Remote code execution / talking-stick
talking-stick
CLI coordination tool for path-scoped agent handoffs.
This report shows the evidence for talking-stick@0.13.0. 2 of 13 known versions are blocked or flagged. The newest version, 0.23.0, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete, unconsented install-time remote binary execution with no independent authenticity verification. The lifecycle guard does not mitigate the risk for normal npm installs.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm installation of talking-stick@0.13.0 under node_modules/talking-stick
Impact
Remote release or environment override can cause arbitrary code execution as the installing user.
Mechanism
postinstall remote native-binary bootstrap and execution
Attack narrative
During npm postinstall, the package invokes skiller-bootstrap.cjs. Unless disabled or a usable binary exists, it fetches a checksum file and a platform archive from a GitHub release URL that can be overridden by environment variables. It validates the archive against the co-hosted checksum, copies the extracted executable to the user's local bin directory, and runs it. A compromised release or override therefore yields install-time arbitrary code execution.
AI rationale
This is concrete, unconsented install-time remote binary execution with no independent authenticity verification. The lifecycle guard does not mitigate the risk for normal npm installs.
Evidence
package.jsonscripts/postinstall.cjsscripts/skiller-bootstrap.cjsdist/skill-install.js
Network endpoints1
github.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- postinstall runs a bootstrapper during npm installation.
- Bootstrapper downloads a platform archive from GitHub, with URL/repository overrideable by environment.
- The checksum is fetched from the same remote location as the executable archive.
- It copies the extracted binary into the user bin directory and executes it for version validation.
Evidence against
- Postinstall only activates when installed beneath node_modules/talking-stick.
- Skill synchronization only refreshes already-installed skill targets.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/process-utils.jsView file
1import { execFileSync } from "node:child_process";
L2: export function terminateKnownProcess(processRef, options) {
High
Child Process
Package source references child process execution.
dist/process-utils.jsView on unpkg · L1Findings
9 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/process-utils.js
HighShelldist/instructions.js
HighSame File Env Network Executionscripts/skiller-bootstrap.cjs
HighKnown Malware Source Similarityscripts/skiller-bootstrap.cjs
HighKnown Malware Source Similaritydist/cli/guardian.js
HighKnown Malware Source Similaritydist/install.js
HighKnown Malware Source Similaritydist/instructions.js
HighKnown Malware Source Similaritydist/skiller-adapter.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to talking-stick@0.13.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing talking-stick@0.13.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.