registry / Install hook abuse / talking-stick / 0.18.2

talking-stick@0.18.2

Talking Stick now ships as a standalone binary. Install with: curl -fsSL https://raw.githubusercontent.com/mostlydev/talking-stick/master/scripts/install.sh | sh Put ~/.local/bin first on PATH, then remove the npm copy. Existing installs remain functional; future updates ship on GitHub.

CLI coordination tool for path-scoped agent handoffs.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The automatic postinstall download and execution of a separately released binary presents a real supply-chain risk, even though the archive is checksum-checked. Inspected agent configuration code is tied to explicit CLI installation behavior, and no concrete malicious attack was established.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm runs the package postinstall hook when installing talking-stick.

Impact

This adds and runs a separately downloaded executable during package installation; the inspected code does not establish credential theft or agent control hijacking.

Mechanism

The hook launches a bootstrap script that downloads the release checksum and archive, checks the archive hash, extracts the binary, copies it into the user’s local bin directory, and invokes it to read its version.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsscripts/skiller-bootstrap.cjs~/.local/bin/skiller

Network endpoints1

github.com/mostlydev/skiller/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines a postinstall hook that runs scripts/postinstall.cjs.
The postinstall script launches the Skiller bootstrap during npm installation when the package is installed under node_modules and its CLI exists.
The bootstrap downloads a release archive and checksum from a configurable GitHub release location, then verifies the archive against that downloaded checksum.
After verification, the bootstrap installs the binary in the user’s local bin directory and runs it to read its version.
The flagged .claude path is part of a harness configuration path resolver; Claude hook installation is exposed through an explicit CLI command.

Evidence against

The bootstrap can be disabled through environment variables, and a previously usable Skiller binary skips the download.
The inspected setup code does not show credential collection, transmission to an unrelated endpoint, or broad agent configuration mutation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/process-utils.jsView file

1import { execFileSync } from "node:child_process"; L2: export function terminateKnownProcess(processRef, options) {

High

Child Process

Package source references child process execution.

dist/process-utils.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/process-utils.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/process-utils.jsView on unpkg

dist/instructions.jsView file

318stdio: "inherit", L319: shell: true L320: });

High

Shell

Package source references shell execution.

dist/instructions.jsView on unpkg · L318

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/instructions.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/instructions.jsView on unpkg

scripts/skiller-bootstrap.cjsView file

1#!/usr/bin/env node L2: const childProcess = require("node:child_process"); L3: const crypto = require("node:crypto"); L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); ... L8: L9: const SKILLER_VERSION = process.env.TALKING_STICK_SKILLER_VERSION || "v0.1.0"; L10: const SKILLER_MIN_VERSION = process.env.TALKING_STICK_SKILLER_MIN_VERSION || "0.1.0";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/skiller-bootstrap.cjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = scripts/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/skiller-bootstrap.cjsView on unpkg

dist/install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/install.js#virtual:normalized:round1View on unpkg

dist/cli/guardian.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/cli/guardian.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/guardian.jsView on unpkg

dist/install.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/install.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install.jsView on unpkg

dist/skiller-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skiller-adapter.jsView on unpkg

scripts/prepare-release.mjsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = scripts/prepare-release.mjs matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-release.mjsView on unpkg

dist/skill-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skill-install.jsView on unpkg

dist/native-wake.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = talking-stick@0.15.0 matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.15.0 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/native-wake.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/process-utils.jsView file

1import { execFileSync } from "node:child_process"; L2: export function terminateKnownProcess(processRef, options) {

High

Child Process

Package source references child process execution.

dist/process-utils.jsView on unpkg · L1

Findings

14 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/process-utils.js

HighShelldist/instructions.js

HighSame File Env Network Executionscripts/skiller-bootstrap.cjs

HighSemantic Analysis Limiteddist/install.js#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/skiller-bootstrap.cjs

HighKnown Malware Source Similaritydist/cli/guardian.js

HighKnown Malware Source Similaritydist/install.js

HighKnown Malware Source Similaritydist/instructions.js

HighKnown Malware Source Similaritydist/skiller-adapter.js

HighKnown Malware Source Similarityscripts/prepare-release.mjs

Affected versions and remediation

This report applies to talking-stick@0.18.2.

See all versions of talking-stick for other recorded verdicts.

Review the evidence and your use of talking-stick@0.18.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 01:18:57.388Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.