registry / Credential exfiltration / @abuaboud/box / 0.7.9

@abuaboud/box@0.7.9

box: Claude Code on your laptop, the work on a cloud dev machine you reach as <name>.box, with your team databases through MCP.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Source inspection establishes conditional credential forwarding to an unrestricted configured destination and explicit CLI agent configuration changes. These warrant a warning, but the inspected behavior does not establish malicious intent or a blocking install-time attack.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Creating a box with --remote or --agent codex forwards credentials; opening a local box configures its Claude workspace.

Impact

Conditional credential exposure and reduced agent permission safeguards in CLI-created workspaces.

Mechanism

Existing MCP OAuth records enter the box creation request, which uses the configured server without an allowlist. Local setup writes agent permissions and records workspace trust acceptance.

AI rationale

Evidence

dist/cbox.mjs.claude/.credentials.json.claude.json.claude/settings.jsonCLAUDE.md.mcp.json

Network endpoints1

box.abuaboud.me

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json has a publishing hook but no preinstall, install, or postinstall hook.
dist/cbox.mjs reads existing Claude credentials and copies MCP OAuth records, removing only refresh tokens.
The API sends request bodies to a configurable server without a destination allowlist; the default is https://box.abuaboud.me.
Remote box creation, selected by --remote or --agent codex, posts the copied MCP credentials to /api/boxes.
Local CLI setup writes Claude workspace permissions and hooks and marks the workspace trusted without its trust dialog.

Evidence against

The transfers and workspace setup serve an explicit cloud development CLI workflow.
GitHub credentials are used for GitHub authentication; no hidden unrelated recipient or malicious install chain was established.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

10 flagged

dist/cbox.mjsView file

Lines 1-28javascript

1#!/usr/bin/env node

3// src/index.ts

4import { styleText as styleText5 } from "node:util";

5import { Command } from "commander";

6import { input as input2, select as select4 } from "@inquirer/prompts";

8// src/api.ts

9import { spawn } from "node:child_process";

10import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cbox.mjsView on unpkg · L8

11import { join as join2 } from "node:path";

12import { styleText as styleText2 } from "node:util";

14// src/laptop.ts

15import { execFile, execFileSync } from "node:child_process";

16import { gzip } from "node:zlib";

17import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";

18import { homedir, userInfo } from "node:os";

19import { join } from "node:path";

20import ssh2 from "ssh2";

21var CONFIG_DIR = join(homedir(), ".config", "box");

22var BOXES = join(homedir(), ".box");

23var SERVICES = { 5432: "Postgres", 6379: "Redis", 3306: "MySQL", 27017: "MongoDB", 8123: "ClickHouse" };

24function localMcp() {

25 const claudeJson = join(homedir(), ".claude.json");

26 const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {};

27 const skipped = [];

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cbox.mjsView on unpkg · L8

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/cbox.mjsView on unpkg · L8

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cbox.mjsView on unpkg · L8

28 const mcpServers = {};

Lines 210-250javascript

210};

211var save = (c) => {

212 mkdirSync2(CONFIG_DIR, { recursive: true });

213 writeFileSync2(file, JSON.stringify(c, null, 2

Lines 1154-1194javascript

1154import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";

1155import { basename as basename2, dirname as dirname2, join as join6 } from "node:path";

1156import { fileURLToPath } from

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: #!/usr/bin/env node import { styletext as styletext5 } from "node:util"; import { command } from "commander"; import { input as input2, select as select4 } from "@inquirer/prompts"; import { spawn } from "node:child_process"; import { chmodsync, existssync as existssync2, mkdirsync as mkdirsync2, readfilesync as readfilesync2, writefilesync as writefilesync2 } from "node:fs"; import { join as join2 } from "node:path"; import { styletext as styletext2 } from "node:util"; import { execfile, execfilesync } from "node:child_process"; import { gzip } from "node:zlib"; import { existssync, mkdirsync, readdirsync, readfilesync, writefilesync } from "node:fs"

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cbox.mjsView on unpkg

8Trigger-reachable persistence chain: manifest.bin -> dist/box.mjs -> dist/cbox.mjs L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L25: const claudeJson = join(homedir(), ".claude.json"); L26: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L27: const skipped = []; ... L62: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cbox.mjsView on unpkg · L8

Source & flagged code

10 flagged · loading source

dist/cbox.mjsView file

1174const prefix = npmPrefix(); L1175: if (!prefix || process.env.CBOX_NO_UPDATE || process.env.CBOX_UPDATED) return; L1176: const latest = await fetch(LATEST, { signal: AbortSignal.timeout(2500) }).then((r) => r.json()).then((j) => j.version, () => void 0); L1177: if (!latest || !newer(latest, VERSION)) return; L1178: const stop = progress([[0, `Updating box ${VERSION} \u2192 ${latest}`]]); L1179: const done = spawnSync(NPM, installArgs(latest, prefix), { stdio: "ignore" }).status === 0; L1180: stop();

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cbox.mjsView on unpkg · L1174

8Source sends the broad process environment to a literal external destination. L8: // src/api.ts L9: import { spawn } from "node:child_process"; L10: import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs"; ... L20: import ssh2 from "ssh2"; L21: var CONFIG_DIR = join(homedir(), ".config", "box"); L22: var BOXES = join(homedir(), ".box"); ... L25: const claudeJson = join(homedir(), ".claude.json"); L26: const servers = existsSync(claudeJson) ? JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers ?? {} : {}; L27: const skipped = []; ... L62: const paths = [...dirs, ...Object.values(plugins).flat().map((e) => e.installPath), ...Object.values(marketplaces).map((m) => m.installLocation)].map((p) =>

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

Findings

5 Critical5 High3 Medium5 Low

CriticalSame File Env Network Executiondist/cbox.mjs

CriticalHardcoded Runtime Data Exfiltrationdist/cbox.mjs

CriticalCommand Output Exfiltrationdist/cbox.mjs

CriticalPersistence Backdoordist/cbox.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cbox.mjs

HighChild Processdist/cbox.mjs

HighSandbox Evasion Gated Capabilitydist/cbox.mjs

HighExternal Ai Agent Control Surface Mutationdist/cbox.mjs

HighTrigger Reachable Command Output Exfiltrationdist/cbox.mjs

HighTrigger Reachable Persistencedist/cbox.mjs

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @abuaboud/box@0.7.9.

See all versions of @abuaboud/box for other recorded verdicts.

Review the evidence and your use of @abuaboud/box@0.7.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-03 22:42:53.160Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code