registry  /  testify-api-cli  /  1.2.2

testify-api-cli@1.2.2

Zero-config API testing for your terminal

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Install-time script downloads an opaque platform-specific native binary from the package's GitHub Releases and installs it under bin/. This creates unresolved remote binary supply-chain risk but no confirmed malicious behavior in the package source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall; later user invokes testify CLI
Impact
Remote release asset becomes executable CLI code; source shows no exfiltration, persistence, or unauthorized mutation.
Mechanism
postinstall native binary downloader and CLI spawn wrapper
Rationale
The package has real install-time remote binary loading risk, so a warning is appropriate, but the inspected source behavior is package-aligned and does not prove malicious intent or concrete attack behavior.
Evidence
package.jsoninstall.jsbin/testify.jsREADME.mdbin/bin/testify_darwin_amd64.tar.gzbin/testify_darwin_arm64.tar.gzbin/testify_linux_amd64.tar.gzbin/testify_linux_arm64.tar.gzbin/testify_windows_amd64.zipbin/testify_windows_arm64.zipbin/testifybin/testify.exe
Network endpoints1
github.com/nityam123-pixle/testify-cli/releases/download/v${version}/${assetName}

Decision evidence

public snapshot
AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node install.js
  • install.js downloads platform archive from GitHub Releases during install
  • install.js extracts archive into package bin/ and chmods extracted binary
  • bin/testify.js later spawns extracted testify/testify.exe with user args
Evidence against
  • No credential/env harvesting found in inspected JS
  • No AI-agent config/control-surface writes found
  • Network URL is package-aligned with README/repository purpose
  • Downloaded binary is not executed during install by the JS wrapper
  • No persistence or destructive filesystem behavior beyond archive cleanup
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.45 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings