registry / Install hook abuse / talking-stick / 0.18.3

talking-stick@0.18.3

Talking Stick now ships as a standalone binary. Install with: curl -fsSL https://raw.githubusercontent.com/mostlydev/talking-stick/master/scripts/install.sh | sh Put ~/.local/bin first on PATH, then remove the npm copy. Existing installs remain functional; future updates ship on GitHub.

CLI coordination tool for path-scoped agent handoffs.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The automatic postinstall download and execution of a separately released binary presents an unresolved supply-chain risk. The inspected source does not prove malicious intent or a concrete attack payload, so this warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm with the postinstall hook enabled, when no sufficiently recent Skiller binary is found.

Impact

A compromised release source or checksum source could supply code that runs during installation and leaves a binary in the user’s local bin directory. No malicious payload is established by the inspected source.

Mechanism

The bootstrap fetches the release checksum and archive, verifies the archive against that checksum, installs the binary under the user’s local bin directory, and runs it to read its version.

AI rationale

Evidence

package.jsonscripts/postinstall.cjsscripts/skiller-bootstrap.cjs~/.local/bin/skiller

Network endpoints1

github.com/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script when installed under node_modules.
Postinstall downloads a platform-specific Skiller archive from GitHub and checks it against a checksum fetched from the same release base.
The bootstrap copies the binary into the user’s local bin directory and invokes it to check its version.
The agent configuration path resolves to the user’s Codex config directory; this location alone does not establish an attack.

Evidence against

The bootstrap skips downloading when it finds a sufficiently recent Skiller binary and supports environment variables that disable the bootstrap.
No inspected source establishes credential theft or unconsented agent configuration changes during npm installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 547 KB of source, external domains: github.com

Source & flagged code

15 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/process-utils.jsView file

1import { execFileSync } from "node:child_process"; L2: export function terminateKnownProcess(processRef, options) {

High

Child Process

Package source references child process execution.

dist/process-utils.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/process-utils.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/process-utils.jsView on unpkg

dist/instructions.jsView file

318stdio: "inherit", L319: shell: true L320: });

High

Shell

Package source references shell execution.

dist/instructions.jsView on unpkg · L318

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/instructions.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/instructions.jsView on unpkg

scripts/skiller-bootstrap.cjsView file

1#!/usr/bin/env node L2: const childProcess = require("node:child_process"); L3: const crypto = require("node:crypto"); L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); ... L8: L9: const SKILLER_VERSION = process.env.TALKING_STICK_SKILLER_VERSION || "v0.1.0"; L10: const SKILLER_MIN_VERSION = process.env.TALKING_STICK_SKILLER_MIN_VERSION || "0.1.0";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/skiller-bootstrap.cjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = scripts/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/skiller-bootstrap.cjsView on unpkg

dist/install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/install.js#virtual:normalized:round1View on unpkg

dist/cli/guardian.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/cli/guardian.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/guardian.jsView on unpkg

dist/install.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/install.js matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install.jsView on unpkg

dist/skiller-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = dist/sk[redacted] matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skiller-adapter.jsView on unpkg

scripts/prepare-release.mjsView file

•matchType = normalized_sha256 matchedPackage = talking-stick@0.13.0 matchedPath = scripts/prepare-release.mjs matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-release.mjsView on unpkg

dist/skill-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skill-install.jsView on unpkg

dist/native-wake.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = talking-stick@0.15.0 matchedIdentity = npm:dGFsa2luZy1zdGljaw:0.15.0 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/native-wake.jsView on unpkg

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/process-utils.jsView file

1import { execFileSync } from "node:child_process"; L2: export function terminateKnownProcess(processRef, options) {

High

Child Process

Package source references child process execution.

dist/process-utils.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/process-utils.jsView on unpkg

dist/instructions.jsView file

318stdio: "inherit", L319: shell: true L320: });

High

Shell

Package source references shell execution.

dist/instructions.jsView on unpkg · L318

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/instructions.jsView on unpkg

scripts/skiller-bootstrap.cjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/skiller-bootstrap.cjsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/skiller-bootstrap.cjsView on unpkg

dist/install.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/install.js#virtual:normalized:round1View on unpkg

dist/cli/guardian.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/guardian.jsView on unpkg

dist/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/install.jsView on unpkg

dist/skiller-adapter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skiller-adapter.jsView on unpkg

scripts/prepare-release.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/prepare-release.mjsView on unpkg

dist/skill-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/skill-install.jsView on unpkg

dist/native-wake.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/native-wake.jsView on unpkg

Findings

14 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/process-utils.js

HighShelldist/instructions.js

HighSame File Env Network Executionscripts/skiller-bootstrap.cjs

HighSemantic Analysis Limiteddist/install.js#virtual:normalized:round1

HighKnown Malware Source Similarityscripts/skiller-bootstrap.cjs

HighKnown Malware Source Similaritydist/cli/guardian.js

HighKnown Malware Source Similaritydist/install.js

HighKnown Malware Source Similaritydist/instructions.js

HighKnown Malware Source Similaritydist/skiller-adapter.js

HighKnown Malware Source Similarityscripts/prepare-release.mjs

HighKnown Malware Source Similaritydist/process-utils.js

HighKnown Malware Source Similaritydist/skill-install.js

HighPrevious Version Dangerous Deltadist/native-wake.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to talking-stick@0.18.3.

See all versions of talking-stick for other recorded verdicts.

Review the evidence and your use of talking-stick@0.18.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-10 01:18:58.673Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.