registry  /  testify-api-cli  /  1.0.3

testify-api-cli@1.0.3

Zero-config API testing for your terminal

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established by source inspection. The package is an npm wrapper that downloads and runs a package-aligned prebuilt CLI binary.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user-invoked testify runs bin/testify.js.
Impact
Executes a downloaded package binary, but source shows no concrete malicious behavior.
Mechanism
install-time GitHub release binary download and CLI spawn wrapper
Rationale
The lifecycle hook and child_process usage are consistent with a documented binary-distribution CLI wrapper, and inspection found no exfiltration, persistence, destructive behavior, or agent-control hijack. Lack of archive hash verification is supply-chain risk but not evidence this package version is malicious.
Evidence
package.jsoninstall.jsbin/testify.jsREADME.mdbin/bin/testify_darwin_amd64.tar.gzbin/testify_darwin_arm64.tar.gzbin/testify_linux_amd64.tar.gzbin/testify_linux_arm64.tar.gzbin/testify_windows_amd64.zipbin/testify_windows_arm64.zipbin/testifybin/testify.exe
Network endpoints3
github.com/nityam123-pixle/testify-cli/releases/download/v${version}/${assetName}github.com/nityam123-pixle/testify-cligithub.com/nityam123-pixle/testify-cli-npm.git

Decision evidence

public snapshot
AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json runs postinstall: node install.js.
  • install.js downloads a platform archive from GitHub Releases and extracts it with tar or PowerShell Expand-Archive.
  • bin/testify.js spawns the installed bundled binary with user CLI arguments.
Evidence against
  • install.js chooses fixed asset names from package version, platform, and arch under the package's GitHub release path.
  • Downloaded archive is written under package bin/ and removed after extraction; no home/project/agent config writes found.
  • No credential/env harvesting, persistence, destructive actions, eval/vm, or AI-agent control-surface mutation found in source.
  • README documents the install-time binary download behavior as the package purpose.
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.45 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings