registry / vedoc-cli / 1.0.1

vedoc-cli@1.0.1

Blazing fast, AI powered API documentation generator

AI Security Review

scanned 7h ago · by lpm-firewall-ai

Installation fetches an unverified native binary from a GitHub release and saves it inside the package. Invoking `vedoc` executes that downloaded binary.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs `postinstall`; a user later runs `vedoc`.

Impact

A substituted or compromised release asset could run arbitrary native code when the CLI is used.

Mechanism

postinstall native-binary download followed by launcher execution

Rationale

No source evidence establishes malicious intent or data theft, but install-time retrieval of an unverified executable leaves a material remote payload risk. This warrants a warning rather than a block.

Evidence

package.jsoninstall.jsbin/vedoc.jsvedocvedoc.exe

Network endpoints1

github.com

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` runs `node install.js` on `postinstall`.

vedoc-cli@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code