registry / @agentic-dev.ai/emo / 0.1.18
@agentic-dev.ai/emo@0.1.18
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged behaviors match the package's described purpose: service keys are used with their own services, and optional remote access uses Cloudflare Tunnel. No install hook or unauthorized credential exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The CLI and integrations run after a user starts EMO; remote tunneling starts when its configuration is ready.
Impact
No unauthorized collection or harmful action was identified in the inspected paths.
Mechanism
Configured credentials are used with their corresponding services, and cloudflared is obtained from Cloudflare's official GitHub releases for the remote-access feature.
AI rationale
The flagged behaviors match the package's described purpose: service keys are used with their own services, and optional remote access uses Cloudflare Tunnel. No install hook or unauthorized credential exfiltration was found.
Evidence
EMO_HOME/state/remote.jsonEMO_HOME/bin/cloudflaredEMO_HOME/state/cloudflared/config.yml
Network endpoints4
github.comapi.sumit.co.ilapi.brightdata.comws.shw.co.il
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines no install, preinstall, or postinstall lifecycle script.
- The CLI starts the application when the user invokes `emo`; its first regular start may enable startup for this application.
- The remote-access feature downloads Cloudflare Tunnel from its official GitHub release host.
- SUMIT credentials are configured for requests to SUMIT's own API; the BrightData token is sent to BrightData's own API for usage reporting.
Evidence against
- The scanner flags credential flows, execution, and persistence, but the inspected code ties these to configured integrations and EMO startup.
- The flagged remote module writes a tunnel configuration and runs cloudflared when remote access is configured; it does not execute an unrelated downloaded payload.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
High
8Trigger-reachable persistence chain: manifest.bin -> bin/emo.mjs
L8: import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
...
L13: const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
L14: const PKG = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
L15: const HOME = path.resolve(process.env.EMO_HOME || path.join(os.homedir(), 'EMO'));
L16: const WIN = process.platform === 'win32', MAC = process.platform === 'darwin';
L17: const cfg = (() => { try { return JSON.parse(fs.readFileSync(path.join(HOME, 'config.json'), 'utf8')); } catch { return {}; } })();
L18: const PORT = Number(process.env.PORT || cfg.port || 8787);
L19: const URL_ = `http://localhost:${PORT}`;
L
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
bin/emo.mjsView on unpkg · L88import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
...
L13: const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
L14: const PKG = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
L15: const HOME = path.resolve(process.env.EMO_HOME || path.join(os.homedir(), 'EMO'));
L16: const WIN = process.platform === 'win32', MAC = process.platform === 'darwin';
L17: const cfg = (() => { try { return JSON.parse(fs.readFileSync(path.join(HOME, 'config.json'), 'utf8')); } catch { return {}; } })();
L18: const PORT = Number(process.env.PORT || cfg.port || 8787);
L19: const URL_ = `http://localhost:${PORT}`;
L20: const say = (...a) => console.log(...a);
...
L24: const sh =
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/emo.mjsView on unpkg · L8lib/videos.mjsView file
13import crypto from 'node:crypto';
L14: import { execFile } from 'node:child_process';
L15:
...
L53: return new Promise(ok => execFile(bin, args, { timeout, windowsHide: true, encoding: 'utf8', maxBuffer: 10e6 },
L54: (err, stdout) => ok({ err, stdout: stdout || '' })));
L55: }
...
L63: function wingetBin(name) {
L64: if (process.platform !== 'win32' || !process.env.LOCALAPPDATA) return null;
L65: const base = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'WinGet', 'Packages');
...
L154: try {
L155: const d = parseFloat(JSON.parse(r.stdout).format.duration);
L156: if (!Number.isFinite(d)) return '';
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/videos.mjsView on unpkg · L13server.mjsView file
1413// async (10-27): spawnSync here froze the whole server (every agent, every approval) for the length of the conversion
L1414: const status = await new Promise(r => { try { const p = spawn(process.env.FFMPEG || 'ffmpeg', ['-y', '-loglevel', 'error', '-i', file, '-vn', '-c:a', 'libopus', '-b:a', '32k', ogg]...
L1415: p.on('error', () => r(-1)); p.on('exit', c => r(c)); } catch { r(-1); } });
...
L1424: form.append('file', new Blob([fs.readFileSync(file)]), path.basename(file));
L1425: const r = await fetch(`https://${String(id).slice(0, 4)}.media.greenapi.com/waInstance${id}/sendFileByUpload/${token}`, { method: 'POST', body: form });
L1426: const j = await r.json().catch(() => ({}));
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
server.mjsView on unpkg · L14131// EMO — personal command center over Claude Code agents.
L2: // Run: node server.mjs → http://localhost:8787
L3: import http from 'node:http';
...
L7: import { randomUUID, randomBytes, scryptSync, timingSafeEqual, createHash } from 'node:crypto';
L8: import { spawn, spawnSync } from 'node:child_process';
L9: import { fileURLToPath } from 'node:url';
...
L44: const ASK_OWNER = new Set(['ask_owner', LEGACY_ASK_TOOL].filter(Boolean)); // the yes/no question tool, and its old name (older skills)
L45: process.env.CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS ||= '1'; // the CLI tells when a run is really over (session_state_changed 'idle'); see the run loop
L46:
...
L87: try { fs.readSync(fd, buf, 0, buf.length, c.size); } finally { fs.closeSync(fd); }
L88: const parts = (c.rest + buf.toString(
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
server.mjsView on unpkg · L1mcp/sumit.mjsView file
22Source sends the broad process environment to a literal external destination.
L22: try { process.loadEnvFile(h('.env')); } catch {}
L23: const BASE = 'https://api.sumit.co.il';
L24: const MAX = 40000;
...
L26: // every SUMIT account in .env: SUMIT_<NAME>_COMPANY_ID + SUMIT_<NAME>_API_KEY (NAME = the company id in config.json, upper-cased)
L27: const COMPANIES = Object.fromEntries(Object.keys(process.env).map(k => k.match(/^SUMIT_(\w+)_API_KEY$/)?.[1]).filter(Boolean).map(N => [N.toLowerCase(), {
L28: CompanyID: Number(process.env[`SUMIT_${N}_COMPANY_ID`]), APIKey: process.env[`SUMIT_${N}_API_KEY`] }])
...
L46: const r = await fetch(BASE + p, { method: 'POST', headers: { 'content-type': 'application/json', accept: raw ? '*/*' : 'application/json' },
L47: body: JSON.stringify({ Credentials:
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
mcp/sumit.mjsView on unpkg · L22lib/remote.mjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @agentic-dev.ai/emo@0.1.17
matchedIdentity = npm:QGFnZW50aWMtZGV2LmFpL2Vtbw:0.1.17
similarity = 0.936
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
lib/remote.mjsView on unpkg1// A remote address for this install (10-31): https://<name>-emo.agentic-dev.ai → this computer, through a Cloudflare tunnel.
L2: // The install asks for a name on its own row at the hub (remote.want); the hub admin's computer provisions the tunnel and the
...
L9: import path from 'node:path';
L10: import { spawn, execFileSync } from 'node:child_process';
L11: import { h } from './home.mjs';
...
L18: export async function remoteDomain() {
L19: if (process.env.EMO_REMOTE_DOMAIN) return process.env.EMO_REMOTE_DOMAIN;
L20: if (process.env.EMO_HUB_BASE || !SITE) return domainCache.v; // a test's fake hub serves no remote.json
L21: if (domainCache.v && Date.now() - domainCache.at < 864e5) return domainCache.v;
L22: try { const j = await (await fetch(`${SITE}/remote.json`, { signal: AbortSig
High
Remote System File Write
Source writes bytes from a remote response into a privileged operating-system path.
lib/remote.mjsView on unpkg · L1windows/start-emo.cmdView file
•path = windows/start-emo.cmd
kind = build_helper
sizeBytes = 1121
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
windows/start-emo.cmdView on unpkgmcp/sumit.mjs#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
mcp/sumit.mjs#virtual:normalized:round1View on unpkgFindings
4 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltalib/remote.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighSemantic Analysis Limitedmcp/sumit.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencebin/emo.mjs
MediumShips Build Helperwindows/start-emo.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/videos.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.18.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.