@aiosbrain/aios: Suspicious npm security report (Warn)

Loading npm security reports…

@aiosbrain/aios: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

29 flagged

package.jsonView file

Lines 26-66json

26 "packages/foundation/src",

27 "packages/foundation/package.json",

28 ".claude/rubrics/spec-readiness.md",

29 "docs/brain-api.md",

30 "docs/agentic-ergonomics/aios-issue-template.md",

31 "docs/agentic-ergonomics/aios-finding-template.md",

32 "docs/devtools-*.md",

33 "docs/ENGINEERING-CONSTITUTION.md",

34 "docs/GETTING-STARTED.md",

35 "docs/mcp-host-install.md",

36 "docs/guard-verification.md",

37 "CHANGELOG.md",

38 "build.json"

39 ],

40 "workspaces": [

41 "packages/foundation"

42 ],

43 "scripts": {

44 "help": "node scripts/npm-menu.mjs",

45 "prepack": "npm run build:terminal && node scripts/write-build-provenance.mjs",

46 "postinstall": "node scripts/ensure-loop-built.mjs && node scripts/postinstall-banner.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "aios": "dotenvx run -- node scripts/aios.mjs",

48 "gen:catalog": "node scripts/gen-catalog.mjs",

49 "build:loop": "tsc -p tsconfig.json --noEmitOnError",

50 "check:context": "node scripts/check-context.mjs",

51 "check:docs": "node scripts/check-docs-drift.mjs",

52 "check:domains": "node scripts/check-domain-isolation.mjs",

53 "check:size": "node scripts/check-file-size.mjs",

54 "check:boundaries": "node scripts/check-boundaries.mjs",

55 "check:codebase-health": "node scripts/check-codebase-health.mjs",

56 "check:v1-linear": "node scripts/check-v1-linear-drift.mjs",

57 "check:workflow-policy": "node scripts/check-workflow-policy.mjs",

58 "check:inbox-audit": "node scripts/inbox-redaction-lint.mjs",

59 "integration:contracts:validate": "node scripts/integration-contracts.mjs",

60 "check:review-evidence-parity": "node scripts/check-review-evidence-parity.mjs",

61 "check:retired-routes": "node scripts/check-retired-routes.mjs",

62 "check:linear-skill-parity": "node scripts/check-linear-skill-parity.mjs",

63 "guard:selftest": "node scripts/guard-selftest.mjs",

64 "eval:transcripts": "node evals/transcript-extraction/extraction-eval.mjs",

65 "pr:backlog": "node scripts/pr-backlog-report.mjs",

66 "lint": "eslint scripts validation src test packages",

validation/check-secrets.shView file

Lines 91-131shell

91 # allowlisting a real credential that merely begins with those bytes.

92 sanitized=$(printf '%s\n' "$sanitized" | sed -E "s/(^|[^A-Za-z0-9_-])${placeholder}([^A-Za-z0-9_-]|$)/\\1\\2/g"

dist/operator-loop/connectors.jsView file

Lines 1-26javascript

1// AIO-366 — bounded, fail-open connector preamble for a recording owner daily run.

2//

3// This is loop-core (the composition point), not a workflow domain: it invokes the shipped

4// connector adapters concurrently, waits until each has exited or hit ITS OWN deadline, and returns

5// non-secret status values. Connector stdout/stderr is never inherited, so `loop daily --json`

6// remains a clean machine surface and a failing connector cannot leak response/credential text.

7import { spawn } from "node:child_process";

8import

scripts/loop-install.mjs#virtual:normalized:round1View file

115// A single job may run more than one CLI invocation (the weekly bundle) — always wrap in L116: // /bin/sh -c so both launchd (single ProgramArguments exec) and cron (already a shell) run L117: // the same command line.

High

Shell

Package source references shell execution.

scripts/loop-install.mjs#virtual:normalized:round1View on unpkg · L115

dist/terminal/theme.jsView file

Lines 1-26javascript

1import { jsx as _jsx } from "react/jsx-runtime";

2import { createRequire } from "node:module";

3import { readFileSync } from "node:fs";

4import { createTheme, ThemeProvider } from

scripts/loop-install.mjsView file

Lines 8-48javascript

8 * Environment heuristic (kept deliberately simple — see docs/loop-install.md):

9 * macOS → launchd LaunchAgent (StartCalendarInterval gives free catch-up-on-wake: a job

10 * missed while the laptop was asleep runs as

scripts/relay-core.mjsView file

Lines 77-117javascript

77];

79// Allowlist: letters, digits, hyphens, underscores, forward-slash, dots only.

80// Rejects any shell metacharacter before it reaches execFileSync.

81export const VALID_BRANCH_RE = /^[a-zA-Z0-9._/-]+$/;

83// c / die imported at the top of this file; re-exported so relay-core.mjs stays a

84// valid import surface for its existing consumers.

scripts/ci-workflow.mjsView file

2import { existsSync, readFileSync, writeFileSync } from "node:fs"; L3: import { execFileSync } from "node:child_process"; L4: import readline from "node:readline/promises"; ... L54: log(CI_WORKFLOW_EXPLANATION); L55: const rl = createInterface({ input: process.stdin, output: process.stdout }); L56: const answer = await rl.question("Are you actively building a codebase with AI? [y/N] "); ... L62: export function ghExecutable({ L63: platform = process.platform, L64: env = process.env, L65: exists = existsSync, ... L81: reason: L82: "GitHub CLI (`gh`) is not installed in a trusted location. Install it from https://cli.github.com/, then rerun this action.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/ci-workflow.mjsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/ci-workflow.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ci-workflow.mjsView on unpkg

scripts/export-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: n firstlinesummary(body) { const line = body .split("\n") .map((l) => l.trim()) .find((l) => l && !l.startswith("#") && !l.startswith("---")); return (line ?? "aios workflow command").slice(0, 160); } function wrapcommand(name, sourcebody) { const description = firstlinesummary(sourcebody); return `---\ndescription: ${description.replace(/"/g, '\\"')}\nstatus: active\n---\n\n${sourcebody.trim()}\n`; } function exportcommands({ commandsdir, outdir }) { if (!existssync(commandsdir)) { console.error(`error: commands dir not found: ${commandsdir}`); process.exit(1); } mkdirsync(outdir, { recursive: true }); const files = readdirsync(commandsdir).filter((f) => f.endsw

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/export-commands.mjsView on unpkg

scripts/gen-catalog.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. k += `\n`; } if (others.length) { sk += `## skills\n\n| skill | what it does |\n|---|---|\n`; for (const s of others) sk += `| \`${s.name}\` | ${firstsentence(s.description)} |\n`; sk += `\n`; } sk += `## share a skill\n\npush a skill to the team brain so teammates can pull it:\n\n` + "```bash\naios push skill <name> # share skill.md + its reference files\naios pull skill <name> # fetch a shared skill into 1-inbox/from-brain/skills/\naios install-skill <name> # promote a pulled skill into .claude/skills/ (explicit, append-only)\n```\n\n" + `pulled skills are executable code — install is always a deliberate act; they never auto-activate

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/gen-catalog.mjsView on unpkg

hooks/aios-sync-nudge.shView file

•path = hooks/aios-sync-nudge.sh kind = build_helper sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/aios-sync-nudge.shView on unpkg

scaffold/.claude/skills/evolve/scripts/evolve_evidence.pyView file

•path = scaffold/.claude/skills/evolve/scripts/evolve_evidence.py kind = payload_in_excluded_dir sizeBytes = 12349 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scaffold/.claude/skills/evolve/scripts/evolve_evidence.pyView on unpkg

hooks/claim-check-guard.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 29

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/claim-check-guard.mjs#virtual:normalized:round1View on unpkg

packages/foundation/src/internal/skill-scan.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = [redacted][redacted] matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/foundation/src/internal/skill-scan.mjsView on unpkg

hooks/local-bugbot-gate.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = hooks/local-bugbot-gate.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/local-bugbot-gate.mjsView on unpkg

scripts/model-call.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/model-call.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/model-call.mjsView on unpkg

scripts/timeline.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/timeline.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/timeline.mjsView on unpkg

scripts/inbox.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/inbox.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inbox.mjsView on unpkg

scripts/onboard-create.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/onboard-create.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/onboard-create.mjsView on unpkg

scripts/review-bugbot/lockfile-gate.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/review-bugbot/lockfile-gate.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/review-bugbot/lockfile-gate.mjsView on unpkg

scripts/review-bugbot/trusted-env.mjsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/review-bugbot/trusted-env.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/review-bugbot/trusted-env.mjsView on unpkg

dist/operator-loop/inbox/notify-telegram.jsView file

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = dist/operator-loop/inbox/notify-telegram.js matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/operator-loop/inbox/notify-telegram.jsView on unpkg

Source & flagged code

29 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/ensure-loop-built.mjs && node scripts/postinstall-banner.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/ensure-loop-built.mjs && node scripts/postinstall-banner.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

validation/check-secrets.shView file

111patternName = generic_password severity = medium line = 111

Medium

Secret Pattern

Package contains a possible secret pattern.

validation/check-secrets.shView on unpkg · L111

112patternName = generic_password severity = medium line = 112

Medium

Secret Pattern

Hardcoded password in validation/check-secrets.sh

validation/check-secrets.shView on unpkg · L112

dist/operator-loop/connectors.jsView file

6// remains a clean machine surface and a failing connector cannot leak response/credential text. L7: import { spawn } from "node:child_process"; L8: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/operator-loop/connectors.jsView on unpkg · L6

scripts/loop-install.mjs#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

scripts/loop-install.mjs#virtual:normalized:round1View on unpkg · L115

dist/terminal/theme.jsView file

6import { UnicodeProvider } from "./vendor/providers/unicode-provider.js"; L7: const require = createRequire(import.meta.url); L8: // Compatibility with design 0.3–0.6, before the additive /terminal export ships.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/terminal/theme.jsView on unpkg · L6

scripts/loop-install.mjsView file

28Trigger-reachable persistence chain: manifest.bin -> scripts/aios.mjs -> scripts/cli.mjs -> scripts/cli/bootstrap.mjs -> scripts/cli/dispatch.mjs -> scripts/cli/registry.mjs -> scripts/loop.mjs -> scripts/loop-install.mjs L28: * (plan building, plist/cron-line generation, idempotent merge) without touching the real L29: * ~/Library/LaunchAgents or the real crontab. L30: */ ... L32: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from "node:fs"; L33: import { execFileSync } from "node:child_process"; L34: import os from "node:os"; ... L49: * Native win32 is refused explicitly (AIO-451): without this, the cron fallback dies with an L50: * opaque ENOENT on crontab//bin/sh. WSL reports `linux`, so it takes the cron path as intended. */ L51: export function detectSched

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/loop-install.mjsView on unpkg · L28

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/loop-install.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/loop-install.mjsView on unpkg

28* (plan building, plist/cron-line generation, idempotent merge) without touching the real L29: * ~/Library/LaunchAgents or the real crontab. L30: */ ... L32: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from "node:fs"; L33: import { execFileSync } from "node:child_process"; L34: import os from "node:os"; ... L49: * Native win32 is refused explicitly (AIO-451): without this, the cron fallback dies with an L50: * opaque ENOENT on crontab//bin/sh. WSL reports `linux`, so it takes the cron path as intended. */ L51: export function detectScheduler(platform = process.platform) { L52: if (platform === "win32") throw new Error(WIN32_UNSUPPORTED_MESSAGE); ... L108: platform = process.platform, L109: home = os.homedir(),

scripts/relay-core.mjsView file

9Source sends the broad process environment to a literal external destination. L9: L10: import { spawn, execFileSync } from "node:child_process"; L11: import { createInterface } from "node:readline"; ... L97: } = {}) { L98: if (requireAnthropic && !process.env.ANTHROPIC_API_KEY) { L99: die("ANTHROPIC_API_KEY is not set. Add it to your .env or export it in your shell."); ... L104: } catch { L105: die("cursor CLI not found. Install: curl https://cursor.com/install -fsS | bash"); L106: } ... L131: return new Promise((resolve, reject) => { L132: process.stdout.write(`\n[${label}] invoking agent...\n`); L133:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/relay-core.mjsView on unpkg · L9

97} = {}) { L98: if (requireAnthropic && !process.env.ANTHROPIC_API_KEY) { L99: die("ANTHROPIC_API_KEY is not set. Add it to your .env or export it in your shell."); ... L102: try { L103: execFileSync("cursor", ["--version"], { stdio: "pipe" }); L104: } catch { L105: die("cursor CLI not found. Install: curl https://cursor.com/install -fsS | bash"); L106: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/relay-core.mjsView on unpkg · L97

•matchType = normalized_sha256 matchedPackage = @aiosbrain/aios@0.12.0 matchedPath = scripts/relay-core.mjs matchedIdentity = npm:QGFpb3NicmFpbi9haW9z:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

scripts/ci-workflow.mjsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/ci-workflow.mjsView on unpkg · L2

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/ci-workflow.mjsView on unpkg

scripts/export-commands.mjsView file

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/export-commands.mjsView on unpkg

scripts/gen-catalog.mjsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/gen-catalog.mjsView on unpkg

hooks/aios-sync-nudge.shView file

•path = hooks/aios-sync-nudge.sh kind = build_helper sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/aios-sync-nudge.shView on unpkg

scaffold/.claude/skills/evolve/scripts/evolve_evidence.pyView file

•path = scaffold/.claude/skills/evolve/scripts/evolve_evidence.py kind = payload_in_excluded_dir sizeBytes = 12349 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scaffold/.claude/skills/evolve/scripts/evolve_evidence.pyView on unpkg

hooks/claim-check-guard.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 29

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/claim-check-guard.mjs#virtual:normalized:round1View on unpkg

packages/foundation/src/internal/skill-scan.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/foundation/src/internal/skill-scan.mjsView on unpkg

hooks/local-bugbot-gate.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

hooks/local-bugbot-gate.mjsView on unpkg

scripts/model-call.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/model-call.mjsView on unpkg

scripts/timeline.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/timeline.mjsView on unpkg

scripts/inbox.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/inbox.mjsView on unpkg

scripts/onboard-create.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/onboard-create.mjsView on unpkg

scripts/review-bugbot/lockfile-gate.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/review-bugbot/lockfile-gate.mjsView on unpkg

scripts/review-bugbot/trusted-env.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/review-bugbot/trusted-env.mjsView on unpkg

dist/operator-loop/inbox/notify-telegram.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/operator-loop/inbox/notify-telegram.jsView on unpkg