@0xmmo/crew@0.3.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@0xmmo/crew@0.3.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

20"scripts": { "build": "tsc", "typecheck": "tsc --noEmit", "test": "npm run build && node --test test/*.test.cjs", "postinstall": "node dist/postinstall.js || true", "version": "node -e \"const fs=require('fs');const v=require('./package.json').version;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}\" && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",

High

Suspicious Lifecycle Evidence

The manifest runs a postinstall script automatically.

package.jsonView on unpkg · L20

•scripts.postinstall = node dist/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/settings.jsView file

10Object.defineProperty(exports, "__esModule", { value: true }); L11: exports.HOOK_EVENTS = exports.HOOK_COMMAND = exports.AGENT_LABELS = exports.AGENTS = void 0; L12: exports.tildify = tildify; ... L20: const opencode_1 = require("./opencode"); L21: exports.AGENTS = ["claude", "codex", "opencode"]; L22: exports.AGENT_LABELS = { ... L40: if (agent === "opencode") L41: return (0, opencode_1.opencodePluginPath)(); L42: if (agent === "codex") { L43: const dir = process.env.CODEX_HOME || (0, node_path_1.join)((0, node_os_1.homedir)(), ".codex"); L44: return (0, node_path_1.join)(dir, "hooks.json"); L45: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/settings.jsView on unpkg · L10

118for (const event of exports.HOOK_EVENTS) { const entries = (hooks[event] ??= []); if (!Array.isArray(entries)) { throw new Error(`hooks.${event} in ${path} is not an array`); } if (hasCrewHook(entries)) continue; entries.push({ hooks: [{ type: "command", command: exports.HOOK_COMMAND }] }); changed = true; } if (!changed) return "already-installed"; (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true }); (0, node_fs_1.writeFileSync)(path, JSON.stringify(settings, null, 2)

High

Ai Review Evidence

The installer writes command hooks into Claude and Codex user configuration for four agent events.

dist/settings.jsView on unpkg · L118

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

dist/postinstall.jsView file

13const isGlobal = process.env.npm[redacted] === "true" || process.env.npm[redacted] === "global"; if (!isGlobal) return; // local/dev install: don't touch user settings for (const agent of settings_1.AGENTS) { const shown = (0, settings_1.tildify)((0, settings_1.settingsPath)(agent)); try { if ((0, settings_1.installHook)(agent) === "installed") { process.stdout.write(`✓ crew wired into ${settings_1.AGENT_LABELS[agent]} (${shown}).\n`);

High

Ai Review Evidence

On global installation, the script installs hooks for Claude Code, Codex, and opencode.

dist/postinstall.jsView on unpkg · L13

Source & flagged code

7 flagged

package.jsonView file

Lines 1-44json

1{

2 "name": "@0xmmo/crew",

3 "version": "0.3.1",

4 "description": "Let Claude Code, Codex, and opencode agents talk to each other: live shared context and agent-to-agent messaging across sessions.",

5 "type": "commonjs",

6 "bin": {

7 "crew": "dist/crew.js"

8 },

9 "files": [

10 "dist",

11 ".claude-plugin",

12 ".codex-plugin",

13 "hooks",

14 "README.md",

15 "LICENSE"

16 ],

17 "engines": {

18 "node": ">=18"

19 },

20 "scripts": {

21 "build": "tsc",

22 "typecheck": "tsc --noEmit",

23 "test": "npm run build && node --test test/*.test.cjs",

24 "postinstall": "node dist/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "version": "node -e \"const fs=require('fs');const v=require('./package.json').version;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}\" && git add .claude-plugin/plugin.json .codex-plugin/plugin.json",

High

Suspicious Lifecycle Evidence

The manifest runs a postinstall script automatically.

package.jsonView on unpkg · L20

26 "send": "npm run build && node -e \"const fs=require('fs');const v=require('./package.json').version.split('.');v[2]=+v[2]+1;for(const p of ['.claude-plugin/plugin.json','.codex-plugin/plugin.json']){const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v.join('.');fs.writeFileSync(p,JSON.stringify(j,null,2)+'\\n')}\" && git add . && (git diff --cached --quiet || git commit -am checkpoint) && npm version patch && npm login && npm publish"

27 },

28 "keywords": [

29 "claude",

30 "claude-code",

31 "codex",

32 "openai-codex",

33 "hooks",

34 "context",

35 "multi-agent",

36 "cli",

37 "sessions",

38 "agents",

39 "terminal",

40 "ndjson",

41 "opencode",

42 "opencode-plugin"

43 ],

44 "author": "",

dist/settings.jsView file

Lines 1-30javascript

1"use strict";

2/**

3 * settings.ts — wire crew's context hook into Claude Code, Codex, and opencode.

4 *

5 * Claude and Codex use the same hook event/config shape: crew is merged into

6 * each user hook file without touching unrelated settings, and never written

7 * over a file we cannot parse. opencode has no hook file; its "install" is a

8 * generated plugin dropped into the global plugins directory (see opencode.ts).

9 */

10Object.defineProperty

dist/crew.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/crew.js#virtual:normalized:round1View on unpkg

dist/postinstall.jsView file

Lines 1-31javascript

1"use strict";

2/**

3 * npm postinstall — auto-wire crew into Claude Code, Codex, and opencode.

4 *

5 * Runs only on global installs (`npm i -g`). Set CREW_NO_HOOK=1 to opt out.

6 * Never fails the install: errors are reported and swallowed.

7 */

8Object.defineProperty(exports, "__esModule", { value: true