registry / @abuaboud/box / 0.7.14

@abuaboud/box@0.7.14

skyfleet: Claude Code on your laptop, the work on a cloud dev machine (a ship) you reach as <name>.skyfleet, with your team databases through MCP.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The flagged collection is tied to user-invoked remote-agent setup and is sent to the package’s configured Box service for that purpose. The manifest has no install hook, and the inspected credential flow does not establish unrelated credential exfiltration or another concrete attack.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The user invokes remote box creation or the setup command.

Impact

The service receives setup data intended to provision the user’s remote agent environment. The inspected source does not show unrelated credential disclosure or an install-time attack.

Mechanism

The CLI reads selected local Claude settings and MCP OAuth data, then sends setup fields to the configured service; copied MCP OAuth data excludes refresh tokens.

AI rationale

Network endpoints1

box.abuaboud.me

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes two CLI commands and lists only a prepublish build script, with no install hook.
The agent setup code reads selected user Claude settings and plugin metadata from the local Claude directory.
The credential helper is used to copy MCP OAuth data, and removes refresh tokens from the copied values.
Remote box creation is reached through the CLI’s new-box flow when remote mode or the Codex agent is selected.
That flow sends MCP configuration and selected Claude home metadata to the configured Box service; its default host is box.abuaboud.me.
The explicit setup flow sends selected skills, plugins, and memory to the configured service.

Evidence against

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

dist/cbox.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/index.ts

4import { styleText as styleText5 } from "node:util";

5import { Command } from "commander";

6import { input as input2, select as select4 } from "@inquirer/prompts";

8// src/api.ts

9import { spawn } from "node:child_process";

10import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cbox.mjsView on unpkg · L8

11import { join as join2 } from "node:path";

12import { styleText as styleText2 } from "node:util";

14// src/laptop.ts

15import { execFile, execFileSync } from "node:child_process";

16import { gzip } from "node:zlib";

17import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";

18import { homedir, userInfo } from "node:os";

19import { join } from "node:path";

20import ssh2 from "ssh2";

21var CONFIG_DIR = join(homedir(), ".config", "box");

22var BOXES = join(homedir(), ".box");

23var MAX_SETUP_MB = 70;

24var SERVICES = { 5432: "Postgres", 6379: "Redis", 3306: "MySQL", 27017: "MongoDB", 8123: "ClickHouse" };

25function localMcp() {

26 const claudeJson = join(homedir(), ".claude.json");

27 const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {};

28 const skipped = [];

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cbox.mjsView on unpkg · L8

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cbox.mjsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cbox.mjsView on unpkg · L8

Lines 218-258javascript

218};

219var save = (c) => {

220 mkdirSync2(CONFIG_DIR, { recursive: true });

221 writeFileSync2(file, JSON.stringify(c, null, 2

Lines 1172-1212javascript

1172import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";

1173import { basename as basename2, dirname as dirname2, join as join6 } from "node:path";

1174import { fileURLToPath } from

•matchType = previous_version_dangerous_delta matchedPackage = @abuaboud/box@0.7.12 matchedIdentity = npm:QGFidWFib3VkL2JveA:0.7.12 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cbox.mjsView on unpkg

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { styletext as styletext5 } from "node:util"; import { command } from "commander"; import { input as input2, select as select4 } from "@inquirer/prompts"; import { spawn } from "node:child_process"; import { chmodsync, existssync as existssync2, mkdirsync as mkdirsync2, readfilesync as readfilesync2, writefilesync as writefilesync2 } from "node:fs"; import { join as join2 } from "node:path"; import { styletext as styletext2 } from "node:util"; import { execfile, execfilesync } from "node:child_process"; import { gzip } from "node:zlib"; import { existssync, mkdirsync, readdirsync, readfilesync, writefilesync } from "node:fs"

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cbox.mjsView on unpkg

8Trigger-reachable persistence chain: manifest.bin -> dist/skyfleet.mjs -> dist/cbox.mjs L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cbox.mjsView on unpkg · L8

Source & flagged code

11 flagged · loading source

dist/cbox.mjsView file

1192const prefix = npmPrefix(); L1193: if (!prefix || process.env.CBOX_NO_UPDATE || process.env.CBOX_UPDATED) return; L1194: const latest = await fetch(LATEST, { signal: AbortSignal.timeout(2500) }).then((r) => r.json()).then((j) => j.version, () => void 0); L1195: if (!latest || !newer(latest, VERSION)) return; L1196: const stop = progress([[0, `Updating ${brand.command} ${VERSION} \u2192 ${latest}`]]); L1197: const done = spawnSync(NPM, installArgs(latest, prefix), { stdio: "ignore" }).status === 0; L1198: stop();

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cbox.mjsView on unpkg · L1192

8Source sends the broad process environment to a literal external destination. L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((p) =>

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

Findings

6 Critical5 High3 Medium5 Low

CriticalSame File Env Network Executiondist/cbox.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/cbox.mjs

CriticalCommand Output Exfiltrationdist/cbox.mjs

CriticalPersistence Backdoordist/cbox.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cbox.mjs

CriticalPrevious Version Dangerous Deltadist/cbox.mjs

HighChild Processdist/cbox.mjs

HighSandbox Evasion Gated Capabilitydist/cbox.mjs

HighExternal Ai Agent Control Surface Mutationdist/cbox.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cbox.mjs

HighTrigger Reachable Persistencedist/cbox.mjs

Affected versions and remediation

This report applies to @abuaboud/box@0.7.14.

See all versions of @abuaboud/box for other recorded verdicts.

Review the evidence and your use of @abuaboud/box@0.7.14 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-19 19:44:12.072Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.