registry  /  testify-api-cli  /  1.2.7

testify-api-cli@1.2.7

Zero-config API testing for your terminal

AI Security Review

scanned 57m ago · by lpm-firewall-ai

The package installs a platform-specific native CLI binary at postinstall and wraps it with a Node bin shim. This is a normal binary-distribution pattern but carries native payload opacity not directly reviewable from JS source.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user invoking testify runs bin/testify.js
Impact
No confirmed malicious behavior in source; installed binary behavior is not visible in the package source.
Mechanism
download, extract, chmod, and execute package-owned native binary
Rationale
Source inspection shows install-time download and execution of a package-owned native CLI from the declared GitHub project, with no source evidence of exfiltration, persistence, destructive actions, or AI-agent control hijacking. Because the package source itself does not contain the native payload, this is a binary installer risk but not concrete malicious behavior under the provided boundary.
Evidence
package.jsoninstall.jsbin/testify.jsbin/bin/testify_darwin_amd64.tar.gzbin/testify_darwin_arm64.tar.gzbin/testify_linux_amd64.tar.gzbin/testify_linux_arm64.tar.gzbin/testify_windows_amd64.zipbin/testify_windows_arm64.zipbin/testifybin/testify.exe
Network endpoints1
github.com/nityam123-pixle/testify-cli/releases/download/v${version}/${assetName}

Decision evidence

public snapshot
AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • postinstall in package.json runs install.js
  • install.js downloads a platform archive from GitHub releases and extracts it into bin/
  • bin/testify.js executes the downloaded native binary with user CLI args
Evidence against
  • No credential/env harvesting or file enumeration found in inspected JS sources
  • Network endpoint is package-aligned GitHub release URL for testify-cli versioned asset
  • No AI-agent control-surface writes, persistence, or destructive behavior found
  • Filesystem writes are limited to package bin directory/archive cleanup/chmod
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 2 file(s), 3.45 KB of source, external domains: github.com

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowFilesystem
LowUrl Strings