registry / Credential exfiltration / @abuaboud/box / 0.7.16

@abuaboud/box@0.7.16

skyfleet: Claude Code on your laptop, the work on a cloud dev machine (a ship) you reach as <name>.skyfleet, with your team databases through MCP.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Static source confirms that remote-box creation sends saved MCP OAuth credentials to the publisher-associated default service without recipient-specific consent. This is concrete credential disclosure and supports blocking the package.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user creates a remote box through the CLI.

Impact

The box service receives saved third-party OAuth credentials, exposing them beyond their intended service.

Mechanism

The CLI reads saved Claude credentials, retains MCP OAuth values while omitting refresh tokens, and includes the remaining values in a POST to the configured box server.

Attack narrative

When remote-box setup runs, the CLI reads saved Claude credentials and includes saved MCP OAuth values in the remote box creation request. The request goes to the configured server, defaulting to https://box.abuaboud.me; the source shows no separate consent for sending those third-party credentials to that recipient.

AI rationale

Evidence

dist/cbox.mjs

Network endpoints1

box.abuaboud.me

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The CLI reads saved Claude credentials from the user’s Claude credentials file or macOS Keychain, then extracts the saved MCP OAuth values.
The CLI sends those saved MCP OAuth values in the remote box creation request without a separate recipient-specific consent check.
The request uses the configured box server, which defaults to the package’s publisher-associated service, and is sent with the CLI’s bearer token.
Creating a remote box is reachable through the CLI’s remote-box command path.

Evidence against

The manifest has no install hook; its prepublishOnly script only builds the package.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 68.5 KB of source, external domains: api.github.com, box.abuaboud.me, github.com, registry.npmjs.org

Source & flagged code

10 flagged

dist/cbox.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/index.ts

4import { styleText as styleText5 } from "node:util";

5import { Command } from "commander";

6import { input as input2, select as select4 } from "@inquirer/prompts";

8// src/api.ts

9import { spawn } from "node:child_process";

10import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cbox.mjsView on unpkg · L8

11import { join as join2 } from "node:path";

12import { styleText as styleText2 } from "node:util";

14// src/laptop.ts

15import { execFile, execFileSync } from "node:child_process";

16import { gzip } from "node:zlib";

17import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";

18import { homedir, userInfo } from "node:os";

19import { join } from "node:path";

20import ssh2 from "ssh2";

21var CONFIG_DIR = join(homedir(), ".config", "box");

22var BOXES = join(homedir(), ".box");

23var MAX_SETUP_MB = 70;

24var SERVICES = { 5432: "Postgres", 6379: "Redis", 3306: "MySQL", 27017: "MongoDB", 8123: "ClickHouse" };

25function localMcp() {

26 const claudeJson = join(homedir(), ".claude.json");

27 const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {};

28 const skipped = [];

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cbox.mjsView on unpkg · L8

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cbox.mjsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cbox.mjsView on unpkg · L8

Lines 218-258javascript

218};

219var save = (c) => {

220 mkdirSync2(CONFIG_DIR, { recursive: true });

221 writeFileSync2(file, JSON.stringify(c, null, 2

Lines 1172-1212javascript

1172import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";

1173import { basename as basename2, dirname as dirname2, join as join6 } from "node:path";

1174import { fileURLToPath } from

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { styletext as styletext5 } from "node:util"; import { command } from "commander"; import { input as input2, select as select4 } from "@inquirer/prompts"; import { spawn } from "node:child_process"; import { chmodsync, existssync as existssync2, mkdirsync as mkdirsync2, readfilesync as readfilesync2, writefilesync as writefilesync2 } from "node:fs"; import { join as join2 } from "node:path"; import { styletext as styletext2 } from "node:util"; import { execfile, execfilesync } from "node:child_process"; import { gzip } from "node:zlib"; import { existssync, mkdirsync, readdirsync, readfilesync, writefilesync } from "node:fs"

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cbox.mjsView on unpkg

8Trigger-reachable persistence chain: manifest.bin -> dist/skyfleet.mjs -> dist/cbox.mjs L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cbox.mjsView on unpkg · L8

Source & flagged code

10 flagged · loading source

dist/cbox.mjsView file

1192const prefix = npmPrefix(); L1193: if (!prefix || process.env.CBOX_NO_UPDATE || process.env.CBOX_UPDATED) return; L1194: const latest = await fetch(LATEST, { signal: AbortSignal.timeout(2500) }).then((r) => r.json()).then((j) => j.version, () => void 0); L1195: if (!latest || !newer(latest, VERSION)) return; L1196: const stop = progress([[0, `Updating ${brand.command} ${VERSION} \u2192 ${latest}`]]); L1197: const done = spawnSync(NPM, installArgs(latest, prefix), { stdio: "ignore" }).status === 0; L1198: stop();

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cbox.mjsView on unpkg · L1192

8Source sends the broad process environment to a literal external destination. L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L26: const claudeJson = join(homedir(), ".claude.json"); L27: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L28: const skipped = []; ... L63: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((p) =>

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

Findings

5 Critical5 High3 Medium5 Low

CriticalSame File Env Network Executiondist/cbox.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/cbox.mjs

CriticalCommand Output Exfiltrationdist/cbox.mjs

CriticalPersistence Backdoordist/cbox.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cbox.mjs

HighChild Processdist/cbox.mjs

HighSandbox Evasion Gated Capabilitydist/cbox.mjs

HighExternal Ai Agent Control Surface Mutationdist/cbox.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cbox.mjs

HighTrigger Reachable Persistencedist/cbox.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @abuaboud/box@0.7.16.

See all versions of @abuaboud/box for other recorded verdicts.

Avoid installing @abuaboud/box@0.7.16. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 18:33:04.356Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages