registry / Credential exfiltration / @abuaboud/box / 0.7.15

@abuaboud/box@0.7.15

skyfleet: Claude Code on your laptop, the work on a cloud dev machine (a ship) you reach as <name>.skyfleet, with your team databases through MCP.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The explicit remote setup forwards saved third-party MCP credential fields to the Box service without a distinct consent gate for that transfer. This warrants a warning for conditional credential exposure; the inspected source does not establish malicious use or support a publish block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user invokes remote-box creation or selects the Codex agent path.

Impact

Credential fields may be exposed to the configured Box service during setup; the source does not establish how the service uses them.

Mechanism

The CLI reads local MCP OAuth credentials, removes refreshToken fields, and includes the remaining values in the remote-box creation request.

AI rationale

Evidence

dist/cbox.mjspackage.json

Network endpoints1

box.abuaboud.me

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package has no install hook; its prepublishOnly script builds the release.
The CLI reads saved MCP OAuth credentials and removes only each refreshToken field before forwarding the remaining fields.
Remote-box creation includes mcpOAuth and Claude agent configuration in a POST request to the configured service.
The service defaults to box.abuaboud.me, and the remote transfer is triggered by the explicit remote-box or Codex CLI path.

Evidence against

Remote-box creation is an explicit CLI action, and the source announces that MCP servers and agent plugins will be copied.
The code strips refresh tokens, and the inspected source does not establish credential misuse or an account compromise.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

10 flagged

dist/cbox.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/index.ts

4import { styleText as styleText5 } from "node:util";

5import { Command } from "commander";

6import { input as input2, select as select4 } from "@inquirer/prompts";

8// src/api.ts

9import { spawn } from "node:child_process";

10import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cbox.mjsView on unpkg · L8

11import { join as join2 } from "node:path";

12import { styleText as styleText2 } from "node:util";

14// src/laptop.ts

15import { execFile, execFileSync } from "node:child_process";

16import { gzip } from "node:zlib";

17import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";

18import { homedir, userInfo } from "node:os";

19import { join } from "node:path";

20import ssh2 from "ssh2";

21var CONFIG_DIR = join(homedir(), ".config", "box");

22var BOXES = join(homedir(), ".box");

23var MAX_SETUP_MB = 70;

24var SERVICES = { 5432: "Postgres", 6379: "Redis", 3306: "MySQL", 27017: "MongoDB", 8123: "ClickHouse" };

25function localMcp() {

26 const claudeJson = join(homedir(), ".claude.json");

27 const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {};

28 const skipped = [];

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cbox.mjsView on unpkg · L8

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cbox.mjsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cbox.mjsView on unpkg · L8

Lines 218-258javascript

218};

219var save = (c) => {

220 mkdirSync2(CONFIG_DIR, { recursive: true });

221 writeFileSync2(file, JSON.stringify(c, null, 2

Lines 1172-1212javascript

1172import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";

1173import { basename as basename2, dirname as dirname2, join as join6 } from "node:path";

1174import { fileURLToPath } from

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { styletext as styletext5 } from "node:util"; import { command } from "commander"; import { input as input2, select as select4 } from "@inquirer/prompts"; import { spawn } from "node:child_process"; import { chmodsync, existssync as existssync2, mkdirsync as mkdirsync2, readfilesync as readfilesync2, writefilesync as writefilesync2 } from "node:fs"; import { join as join2 } from "node:path"; import { styletext as styletext2 } from "node:util"; import { execfile, execfilesync } from "node:child_process"; import { gzip } from "node:zlib"; import { existssync, mkdirsync, readdirsync, readfilesync, writefilesync } from "node:fs"

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cbox.mjsView on unpkg

8Trigger-reachable persistence chain: manifest.bin -> dist/skyfleet.mjs -> dist/cbox.mjs L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cbox.mjsView on unpkg · L8

Source & flagged code

10 flagged · loading source

dist/cbox.mjsView file

1192const prefix = npmPrefix(); L1193: if (!prefix || process.env.CBOX_NO_UPDATE || process.env.CBOX_UPDATED) return; L1194: const latest = await fetch(LATEST, { signal: AbortSignal.timeout(2500) }).then((r) => r.json()).then((j) => j.version, () => void 0); L1195: if (!latest || !newer(latest, VERSION)) return; L1196: const stop = progress([[0, `Updating ${brand.command} ${VERSION} \u2192 ${latest}`]]); L1197: const done = spawnSync(NPM, installArgs(latest, prefix), { stdio: "ignore" }).status === 0; L1198: stop();

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cbox.mjsView on unpkg · L1192

8Source sends the broad process environment to a literal external destination. L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((p) =>

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

Findings

5 Critical5 High3 Medium5 Low

CriticalSame File Env Network Executiondist/cbox.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/cbox.mjs

CriticalCommand Output Exfiltrationdist/cbox.mjs

CriticalPersistence Backdoordist/cbox.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cbox.mjs

HighChild Processdist/cbox.mjs

HighSandbox Evasion Gated Capabilitydist/cbox.mjs

HighExternal Ai Agent Control Surface Mutationdist/cbox.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cbox.mjs

HighTrigger Reachable Persistencedist/cbox.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @abuaboud/box@0.7.15.

See all versions of @abuaboud/box for other recorded verdicts.

Review the evidence and your use of @abuaboud/box@0.7.15 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 18:23:17.116Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code