registry / AI-agent capability abuse / @abuaboud/box / 0.7.12

@abuaboud/box@0.7.12

box: Claude Code on your laptop, the work on a cloud dev machine you reach as <name>.box, with your team databases through MCP.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Source inspection shows no npm install hook or concrete credential theft behavior. The CLI does automatically trust its generated Claude folder and install project hooks, so this warrants a warning for agent configuration capability.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Running the setup command, opening a local box, or creating a remote box.

Impact

Claude may run the generated sync hooks without a trust prompt, and selected skills, plugins, and memory become available to the Box service.

Mechanism

The CLI writes project hooks and permissions, changes Claude’s trust setting for the generated folder, and uploads selected setup metadata or an archive through its authenticated API.

AI rationale

Evidence

dist/cbox.mjs~/.box/<environment>/<box>/.claude/settings.json~/.box/<environment>/<box>/.mcp.json~/.claude.json

Network endpoints1

box.abuaboud.me

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest exposes a CLI and lists build and prepublishOnly scripts; its bin imports the bundled CLI.
The CLI reads Claude settings and selects enabled user plugins installed under the Claude home.
Setup uploads Claude home metadata and includes the archive only when the server requests it; API requests use a bearer token and default to the Box service.
Opening a local box triggers setup upload; the CLI also exposes an explicit setup command, and remote box creation sends selected Claude home data.
The CLI writes hooks, permissions, and MCP settings into its generated box folder, then marks that folder trusted in Claude configuration.

Evidence against

The package has no install lifecycle hook; setup runs through CLI actions.
The upload recipient defaults to the package’s Box service and requests use the saved account token.
The configuration writes target the generated box folder, with hooks invoking Box sync operations.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVars

Source & flagged code

11 flagged

dist/cbox.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/index.ts

4import { styleText as styleText5 } from "node:util";

5import { Command } from "commander";

6import { input as input2, select as select4 } from "@inquirer/prompts";

8// src/api.ts

9import { spawn } from "node:child_process";

10import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cbox.mjsView on unpkg · L8

11import { join as join2 } from "node:path";

12import { styleText as styleText2 } from "node:util";

14// src/laptop.ts

15import { execFile, execFileSync } from "node:child_process";

16import { gzip } from "node:zlib";

17import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";

18import { homedir, userInfo } from "node:os";

19import { join } from "node:path";

20import ssh2 from "ssh2";

21var CONFIG_DIR = join(homedir(), ".config", "box");

22var BOXES = join(homedir(), ".box");

23var MAX_SETUP_MB = 70;

24var SERVICES = { 5432: "Postgres", 6379: "Redis", 3306: "MySQL", 27017: "MongoDB", 8123: "ClickHouse" };

25function localMcp() {

26 const claudeJson = join(homedir(), ".claude.json");

27 const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {};

28 const skipped = [];

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cbox.mjsView on unpkg · L8

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cbox.mjsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cbox.mjsView on unpkg · L8

Lines 211-251javascript

211};

212var save = (c) => {

213 mkdirSync2(CONFIG_DIR, { recursive: true });

214 writeFileSync2(file, JSON.stringify(c, null, 2

Lines 1165-1205javascript

1165import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";

1166import { basename as basename2, dirname as dirname2, join as join6 } from "node:path";

1167import { fileURLToPath } from

•matchType = previous_version_dangerous_delta matchedPackage = @abuaboud/box@0.7.10 matchedIdentity = npm:QGFidWFib3VkL2JveA:0.7.10 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cbox.mjsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { styletext as styletext5 } from "node:util"; import { command } from "commander"; import { input as input2, select as select4 } from "@inquirer/prompts"; import { spawn } from "node:child_process"; import { chmodsync, existssync as existssync2, mkdirsync as mkdirsync2, readfilesync as readfilesync2, writefilesync as writefilesync2 } from "node:fs"; import { join as join2 } from "node:path"; import { styletext as styletext2 } from "node:util"; import { execfile, execfilesync } from "node:child_process"; import { gzip } from "node:zlib"; import { existssync, mkdirsync, readdirsync, readfilesync, writefilesync } from "node:fs"

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cbox.mjsView on unpkg

8Trigger-reachable persistence chain: manifest.bin -> dist/box.mjs -> dist/cbox.mjs L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cbox.mjsView on unpkg · L8

Source & flagged code

11 flagged · loading source

dist/cbox.mjsView file

1185const prefix = npmPrefix(); L1186: if (!prefix || process.env.CBOX_NO_UPDATE || process.env.CBOX_UPDATED) return; L1187: const latest = await fetch(LATEST, { signal: AbortSignal.timeout(2500) }).then((r) => r.json()).then((j) => j.version, () => void 0); L1188: if (!latest || !newer(latest, VERSION)) return; L1189: const stop = progress([[0, `Updating box ${VERSION} \u2192 ${latest}`]]); L1190: const done = spawnSync(NPM, installArgs(latest, prefix), { stdio: "ignore" }).status === 0; L1191: stop();

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cbox.mjsView on unpkg · L1185

8Source sends the broad process environment to a literal external destination. L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((p) =>

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

Findings

6 Critical5 High3 Medium5 Low

CriticalSame File Env Network Executiondist/cbox.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/cbox.mjs

CriticalCommand Output Exfiltrationdist/cbox.mjs

CriticalPersistence Backdoordist/cbox.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cbox.mjs

CriticalPrevious Version Dangerous Deltadist/cbox.mjs

HighChild Processdist/cbox.mjs

HighSandbox Evasion Gated Capabilitydist/cbox.mjs

HighExternal Ai Agent Control Surface Mutationdist/cbox.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cbox.mjs

HighTrigger Reachable Persistencedist/cbox.mjs

Affected versions and remediation

This report applies to @abuaboud/box@0.7.12.

See all versions of @abuaboud/box for other recorded verdicts.

Review the evidence and your use of @abuaboud/box@0.7.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 14:40:26.716Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code