registry  /  testify-api-cli  /  1.2.1

testify-api-cli@1.2.1

Zero-config API testing for your terminal

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The install hook performs package-aligned binary download and extraction, which is risky but matches the declared CLI wrapper behavior.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user running testify invokes bin/testify.js
Impact
Installs and runs the Testify native binary; no source evidence of data theft or unauthorized control-surface mutation
Mechanism
platform-specific GitHub release binary installer and CLI wrapper
Rationale
Static inspection shows a postinstall native-binary downloader, but its behavior is declared, package-aligned, and limited to installing the CLI binary from the project GitHub releases. No concrete exfiltration, persistence, destructive behavior, dependency confusion, prompt injection, or AI-agent control hijack was found.
Evidence
package.jsoninstall.jsbin/testify.jsREADME.mdbin/bin/testifybin/testify.exebin/testify_*.tar.gzbin/testify_*.zip
Network endpoints1
github.com/nityam123-pixle/testify-cli/releases/download/v${version}/${assetName}

Decision evidence

public snapshot
AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json defines postinstall: node install.js
  • install.js downloads a platform archive and extracts it with tar or PowerShell during install
  • Downloaded native binary is not integrity-pinned in source
Evidence against
  • README.md and package.json describe an npm wrapper that downloads prebuilt Testify binaries
  • install.js uses package version, OS, and arch to fetch package-aligned GitHub release assets only
  • bin/testify.js only spawns the local packaged/downloaded testify binary with user CLI args
  • No credential, env, home directory, AI-agent config, persistence, or exfiltration logic found
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.45 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings