registry / terminal-smart-cli / 0.98.1
terminal-smart-cli@0.98.1
Terminal Smart no seu terminal — pergunte, analise logs por pipe e orquestre agentes de IA. Comando: ts
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package has no install hook, and the reviewed credential flows are user-triggered: account login uses pairing with the package backend, while BYOK requests use a provider URL and key supplied during setup. The scanner's browser credential finding is explained by local project testing with seed credentials against localhost.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
CLI commands such as login, provider setup, and project testing; no install-time hook is declared.
Impact
No unauthorized credential transfer, account action, persistence, or destructive behavior was identified.
Mechanism
Login pairs with the package backend, BYOK sends requests to the provider URL the user configured, and the project-testing browser gate uses seed credentials against localhost.
AI rationale
The package has no install hook, and the reviewed credential flows are user-triggered: account login uses pairing with the package backend, while BYOK requests use a provider URL and key supplied during setup. The scanner's browser credential finding is explained by local project testing with seed credentials against localhost.
Network endpoints3
terminalsmart.com.brlocalhost:<selected-port>user-configured BYOK provider URL
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes bin/ts.js and declares only a test script; it has no install lifecycle hook.
- The default API base URL is terminalsmart.com.br, and login uses an explicit CLI pairing flow.
- The browser gate extracts demo credentials from the project being tested and targets a localhost URL.
- BYOK setup prompts the user for a provider URL and API key; requests use the configured provider base URL.
Evidence against
- The CLI performs network requests, browser automation, and process execution as part of its stated terminal agent and project-testing functions.
- The reviewed browser credential flow is limited to signing into the local project under test with credentials found in that project's seed code.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggedbin/ts.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = terminal-smart-cli@0.97.12
matchedIdentity = npm:dGVybWluYWwtc21hcnQtY2xp:0.97.12
similarity = 0.444
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/ts.jsView on unpkg13if (process.platform === 'win32' && process.stdout.isTTY) {
L14: try { require('child_process').execSync('chcp 65001', { stdio: 'ignore' }); } catch (_) {}
L15: }
High
11L12: // Windows legado (cmd.exe): força UTF-8 pro desenho das caixas não virar "?".
L13: if (process.platform === 'win32' && process.stdout.isTTY) {
High
Findings
3 Critical6 High3 Medium6 Low
CriticalBrowser Credential Phishinglib/meta.js
CriticalTrigger Reachable Dangerous Capabilitylib/meta.js
CriticalPrevious Version Dangerous Deltabin/ts.js
HighChild Processbin/ts.js
HighShellbin/ts.js
HighSame File Env Network Executionlib/meta.js
HighCredential Redirect Persistencebin/ts.js
HighSandbox Evasion Gated Capabilitybin/ts.js
HighSemantic Analysis Limitedlib/conhecimento.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to terminal-smart-cli@0.98.1.
See all versions of terminal-smart-cli for other recorded verdicts.
- Review the evidence and your use of terminal-smart-cli@0.98.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.