registry  /  testify-api-cli  /  1.2.5

testify-api-cli@1.2.5

Zero-config API testing for your terminal

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Install-time code downloads and unpacks a native executable from a package-aligned GitHub Release without integrity verification. This creates unresolved remote binary supply-chain risk, but no confirmed malicious behavior is present in the JavaScript source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install postinstall; later user invokes testify CLI
Impact
Potential execution of unverified native binary if the release asset is compromised; source does not show exfiltration or destructive behavior.
Mechanism
postinstall remote binary downloader and CLI wrapper
Rationale
Static inspection confirms a disclosed, package-aligned postinstall binary downloader with shell extraction and no integrity check, which warrants a warning but not a block absent concrete malicious source behavior. No credential theft, exfiltration, destructive actions, persistence, dependency confusion, or AI-agent control hijack were found.
Evidence
package.jsoninstall.jsbin/testify.jsREADME.mdbin/bin/testify_darwin_amd64.tar.gzbin/testify_darwin_arm64.tar.gzbin/testify_linux_amd64.tar.gzbin/testify_linux_arm64.tar.gzbin/testify_windows_amd64.zipbin/testify_windows_arm64.zipbin/testifybin/testify.exe
Network endpoints1
github.com/nityam123-pixle/testify-cli/releases/download/v${version}/${assetName}

Decision evidence

public snapshot
AI called this Suspicious at 83.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: node install.js
  • install.js downloads platform archive from GitHub Releases during install
  • install.js extracts downloaded archive with tar or PowerShell Expand-Archive
  • install.js installs executable into bin/ and chmods it without checksum verification
  • bin/testify.js spawns the installed native binary with user CLI args
Evidence against
  • Download URL is package-aligned: github.com/nityam123-pixle/testify-cli
  • README.md discloses automatic GitHub Releases binary download on install
  • No credential/env harvesting found in inspected source
  • No exfiltration endpoint beyond package release download found
  • No AI-agent control-surface writes or persistence found
  • Runtime wrapper only delegates to local bin/testify or bin/testify.exe
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.45 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings