@aggroot-team/aggroot@1.13.2
AggRoot - AI Assistant (Node.js/TypeScript Version)
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe source confirms default-on runtime telemetry carrying device and session identifiers to a hardcoded HTTP endpoint, so this warrants a warning. The inspected behavior does not establish credential theft or a more severe attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Starting the CLI initializes telemetry; queued events are sent on a timer, when the batch fills, or during shutdown.
Impact
The endpoint can receive device and session identifiers and usage metadata, including tool names, platform, architecture, and Node version.
Mechanism
The runtime posts telemetry batches to the configured endpoint, which defaults to a hardcoded IP address over HTTP.
AI rationale
The source confirms default-on runtime telemetry carrying device and session identifiers to a hardcoded HTTP endpoint, so this warrants a warning. The inspected behavior does not establish credential theft or a more severe attack.
Evidence
dist/index.cjs
Network endpoints1
106.53.152.172:8643
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes a CLI and uses dist/index.cjs as its main entry point.
- Telemetry is enabled by default and targets a hardcoded HTTP address.
- CLI startup initializes telemetry and records platform, architecture, and Node version.
- Telemetry batches include device and session identifiers and are sent in an HTTP POST.
- Tool-use events include tool names, success status, and duration.
Evidence against
- The postinstall hook runs a Playwright Chromium installer; inspected code checks for the required browser revision before downloading it.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/install-browsers.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/cli.cjsView file
2// AggRoot CLI wrapper - ensures Node.js heap is large enough for long sessions.
L3: const v8 = require('node:v8');
L4: const path = require('node:path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/cli.cjsView on unpkg · L2scripts/install-browsers.mjsView file
15Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network
L15:
L16: import { spawn } from "child_process";
L17: import { existsSync, readFileSync } from "node:fs";
...
L23: const MIRRORS = [
L24: { host: "https://npmmirror.com/mirrors/playwright", name: "淘宝镜像" },
L25: { host: "", name: "官方源" },
...
L27:
L28: // npm postinstall 会吞掉 stdout，用 stderr 输出状态让用户看到
L29: function status(msg) {
L30: process.stderr.write(`\n[browsers] ${msg}\n`);
L31: }
...
L38: try {
Findings
6 High9 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencescripts/install-browsers.mjs
HighSemantic Analysis Limitedscripts/test-tokenizer.js
HighKnown Malware Source Similarityshare/web/dist/assets/chunk-AQP2D5EJ-skjsPc_N.js
HighKnown Malware Source Similarityshare/web/dist/assets/flowDiagram-I6XJVG4X-CvspKfMb.js
HighPrevious Version Dangerous Deltascripts/pack-portable.mjs
MediumDynamic Requiredist/cli.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarydist/native/better_sqlite3.node
MediumShips Wasm Moduledist/tree-sitter-c.wasm
MediumShips Build Helper
Affected versions and remediation
This report applies to @aggroot-team/aggroot@1.13.2.
See all versions of @aggroot-team/aggroot for other recorded verdicts.
- Review the evidence and your use of @aggroot-team/aggroot@1.13.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.