registry  /  xei-editor  /  0.1.8

xei-editor@0.1.8

xei (晴) — a modern Vim-like terminal editor in Rust

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface established. The main risk is a conventional native CLI postinstall downloader without checksum verification, but its behavior is aligned with installing the xei editor binary.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs postinstall; user later runs xei CLI
Impact
Installs/runs a native editor binary; file edits/deletes are user-invoked editor commands documented in README.
Mechanism
platform binary download and user-invoked terminal editor
Rationale
Static inspection found a postinstall native-binary downloader, but it is limited to the package binary path and uses package-aligned GitHub release URLs. The shipped binary indicators are consistent with a Rust terminal editor and built-in terminal rather than credential theft, persistence, exfiltration, or AI-agent control hijack.
Evidence
package.jsoninstall.jsREADME.mdbin/xei
Network endpoints2
github.com/stremtec/xei/releases/download/v0.1.8/xei-<target>.gzgit+https://github.com/stremtec/xei.git

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json defines postinstall: node install.js.
  • install.js deletes existing bin/xei then downloads a gzipped platform binary from GitHub releases without checksum verification.
  • bin/xei is a native Mach-O arm64 executable and imports process/file/syscall primitives including exec/spawn-related symbols.
Evidence against
  • install.js URL is package-aligned: github.com/stremtec/xei releases v0.1.8, matching repository metadata.
  • install.js writes only package bin path and chmods it; no credential/env harvesting or exfiltration logic found.
  • README describes a terminal editor; binary strings match editor UI, themes, file explorer, built-in terminal, and documented commands.
  • rg over package/binary found no suspicious secret, npmrc, .ssh, AI-agent control-surface, persistence, or unrelated network endpoints.
Behavioral surface
Source
FilesystemNetwork
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 1.78 KB of source, external domains: github.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/xeiView file
•path = bin/xei kind = native_binary sizeBytes = 989520 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/xeiView on unpkg

Findings

1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumShips Native Binarybin/xei
LowScripts Present
LowFilesystem
LowUrl Strings