@agentic-dev.ai/emo@0.1.27
EMO by Agentic-dev: your own team of AI agents, on your computer, on your Claude subscription.
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe launcher enables login persistence on the first successful start without an explicit autostart request. It runs the package’s own application and offers a way to turn this off, so this warrants a warning rather than a malicious verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs `emo start` successfully for the first time.
Impact
EMO persists across sign-ins and runs its server in the background; the user must disable autostart to prevent this.
Mechanism
The launcher creates a Windows scheduled task or macOS LaunchAgent and records an autostart flag.
AI rationale
The launcher enables login persistence on the first successful start without an explicit autostart request. It runs the package’s own application and offers a way to turn this off, so this warrants a warning rather than a malicious verdict.
Evidence
bin/emo.mjs~/EMO/state/autostart.json~/Library/LaunchAgents/ai.agentic-dev.emo.plistWindows scheduled task Agentic-dev-EMO
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A successful first `emo start` enables autostart by default for regular installs.
- The launcher creates a Windows logon task or a macOS LaunchAgent to run EMO at sign-in.
- The package exposes a CLI and declares no install lifecycle script; the persistence is initiated by the launcher.
Evidence against
- The startup task runs EMO, which is the package’s own application.
- The launcher provides an `autostart off` command to disable it.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
14 flaggedhub.jsonView file
4patternName = google_api_key
severity = high
line = 4
High
4patternName = google_api_key
severity = high
line = 4
High
bin/emo.mjsView file
8import path from 'node:path';
L9: import { spawn, spawnSync } from 'node:child_process';
L10: import { fileURLToPath } from 'node:url';
High
139const [cmd = 'start', arg] = process.argv.slice(2);
L140: // Windows PowerShell 5.1 opens the console on an old code page and the Hebrew comes out garbled: switch it to UTF-8
L141: if (WIN && process.stdout.isTTY) { try { spawnSync('chcp', ['65001'], { shell: true, stdio: 'ignore' }); } catch {} }
Findings
4 Critical7 High5 Medium6 Low
CriticalSame File Env Network Executionserver.mjs
CriticalHardcoded Runtime Data Exfiltrationmcp/sumit.mjs
CriticalCredential Exfiltrationserver.mjs
CriticalPrevious Version Dangerous Deltaserver.mjs
HighHigh Secrethub.json
HighChild Processbin/emo.mjs
HighShellbin/emo.mjs
HighRemote System File Writelib/remote.mjs
HighTrigger Reachable Persistencebin/emo.mjs
HighSemantic Analysis Limitedmcp/sumit.mjs#virtual:normalized:round1
HighSecret Patternhub.json
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @agentic-dev.ai/emo@0.1.27.
See all versions of @agentic-dev.ai/emo for other recorded verdicts.
- Review the evidence and your use of @agentic-dev.ai/emo@0.1.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.