Loading npm security reports…

@aiosbrain/aios@0.12.0: Malicious npm security report (Block) | LPM Firewall

registry / @aiosbrain/aios / 0.12.0

@aiosbrain/aios@0.12.0

Agent-native operating system for an individual contributor: governed workspace scaffold, multi-agent harnesses with rubric-gated self-correction, AIOS Team Brain sync client, and a local GUI.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

npm installation silently installs a persistent Git post-checkout hook in the consuming repository. A later fresh worktree checkout invokes a bundled shell hydration script.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall, followed by a new linked Git worktree checkout.

Impact

This mutates a consumer repository's Git execution surface without an explicit user command and establishes future checkout-triggered code execution.

Mechanism

The lifecycle script passes the current directory to a hook installer, which copies and makes executable a post-checkout hook. That hook locates a hydration script and runs it with Bash.

Attack narrative

Installing the package automatically invokes postinstall. In a Git checkout, it writes an executable post-checkout hook into the consumer repository. On a later fresh worktree checkout, the hook selects a hydration script and executes it with Bash. This is unconsented lifecycle-installed persistence on a broad developer and agent workspace control surface.

AI rationale

The package performs automatic postinstall mutation of a consumer Git hook and arranges future command execution. The checkout guard does not remove the unconsented lifecycle persistence.

Evidence

package.jsonscripts/postinstall-banner.mjsscripts/worktree.mjshooks/git/post-checkout.git/hooks/post-checkout

Decision evidence

public snapshot

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/ensure-loop-built.mjs && node scripts/postinstall-banner.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/ensure-loop-built.mjs && node scripts/postinstall-banner.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

validation/check-secrets.shView file

111patternName = generic_password severity = medium line = 111

Medium

Secret Pattern

Package contains a possible secret pattern.

validation/check-secrets.shView on unpkg · L111

112patternName = generic_password severity = medium line = 112

Medium

Secret Pattern

Hardcoded password in validation/check-secrets.sh

validation/check-secrets.shView on unpkg · L112

dist/operator-loop/connectors.jsView file

6// remains a clean machine surface and a failing connector cannot leak response/credential text. L7: import { spawn } from "node:child_process"; L8: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/operator-loop/connectors.jsView on unpkg · L6

scripts/loop-install.mjs#virtual:normalized:round1View file

115// A single job may run more than one CLI invocation (the weekly bundle) — always wrap in L116: // /bin/sh -c so both launchd (single ProgramArguments exec) and cron (already a shell) run L117: // the same command line.

High

Shell

Package source references shell execution.

scripts/loop-install.mjs#virtual:normalized:round1View on unpkg · L115

dist/operator-loop/asks/store.jsView file

18import { fileURLToPath } from "node:url"; L19: const require = createRequire(import.meta.url); L20: const recoveryPolicy = require(path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "hooks", "asks-claim-recovery.cjs"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/operator-loop/asks/store.jsView on unpkg · L18

scripts/loop-install.mjsView file

28Trigger-reachable persistence chain: manifest.bin -> scripts/aios.mjs -> scripts/cli/dispatch.mjs -> scripts/cli/registry.mjs -> scripts/loop.mjs -> scripts/loop-install.mjs L28: * (plan building, plist/cron-line generation, idempotent merge) without touching the real L29: * ~/Library/LaunchAgents or the real crontab. L30: */ ... L32: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from "node:fs"; L33: import { execFileSync } from "node:child_process"; L34: import os from "node:os"; ... L49: * Native win32 is refused explicitly (AIO-451): without this, the cron fallback dies with an L50: * opaque ENOENT on crontab//bin/sh. WSL reports `linux`, so it takes the cron path as intended. */ L51: export function detectScheduler(platform = process.platform) { L52: if (pla

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/loop-install.mjsView on unpkg · L28

28* (plan building, plist/cron-line generation, idempotent merge) without touching the real L29: * ~/Library/LaunchAgents or the real crontab. L30: */ ... L32: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from "node:fs"; L33: import { execFileSync } from "node:child_process"; L34: import os from "node:os"; ... L49: * Native win32 is refused explicitly (AIO-451): without this, the cron fallback dies with an L50: * opaque ENOENT on crontab//bin/sh. WSL reports `linux`, so it takes the cron path as intended. */ L51: export function detectScheduler(platform = process.platform) { L52: if (platform === "win32") throw new Error(WIN32_UNSUPPORTED_MESSAGE); ... L108: platform = process.platform, L109: home = os.homedir(),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/loop-install.mjsView on unpkg · L28

scripts/relay-core.mjsView file

9Source sends the broad process environment to a literal external destination. L9: L10: import { spawn, execFileSync } from "node:child_process"; L11: import { createInterface } from "node:readline"; ... L97: } = {}) { L98: if (requireAnthropic && !process.env.ANTHROPIC_API_KEY) { L99: die("ANTHROPIC_API_KEY is not set. Add it to your .env or export it in your shell."); ... L104: } catch { L105: die("cursor CLI not found. Install: curl https://cursor.com/install -fsS | bash"); L106: } ... L131: return new Promise((resolve, reject) => { L132: process.stdout.write(`\n[${label}] invoking agent...\n`); L133:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

scripts/relay-core.mjsView on unpkg · L9

97} = {}) { L98: if (requireAnthropic && !process.env.ANTHROPIC_API_KEY) { L99: die("ANTHROPIC_API_KEY is not set. Add it to your .env or export it in your shell."); ... L102: try { L103: execFileSync("cursor", ["--version"], { stdio: "pipe" }); L104: } catch { L105: die("cursor CLI not found. Install: curl https://cursor.com/install -fsS | bash"); L106: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/relay-core.mjsView on unpkg · L97

scripts/ci-workflow.mjsView file

2import { existsSync, readFileSync, writeFileSync } from "node:fs"; L3: import { execFileSync } from "node:child_process"; L4: import readline from "node:readline/promises"; ... L54: log(CI_WORKFLOW_EXPLANATION); L55: const rl = createInterface({ input: process.stdin, output: process.stdout }); L56: const answer = await rl.question("Are you actively building a codebase with AI? [y/N] "); ... L62: export function ghExecutable({ L63: platform = process.platform, L64: env = process.env, L65: exists = existsSync, ... L81: reason: L82: "GitHub CLI (`gh`) is not installed in a trusted location. Install it from https://cli.github.com/, then rerun this action.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/ci-workflow.mjsView on unpkg · L2

scripts/export-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: n firstlinesummary(body) { const line = body .split("\n") .map((l) => l.trim()) .find((l) => l && !l.startswith("#") && !l.startswith("---")); return (line ?? "aios workflow command").slice(0, 160); } function wrapcommand(name, sourcebody) { const description = firstlinesummary(sourcebody); return `---\ndescription: ${description.replace(/"/g, '\\"')}\nstatus: active\n---\n\n${sourcebody.trim()}\n`; } function exportcommands({ commandsdir, outdir }) { if (!existssync(commandsdir)) { console.error(`error: commands dir not found: ${commandsdir}`); process.exit(1); } mkdirsync(outdir, { recursive: true }); const files = readdirsync(commandsdir).filter((f) => f.endsw

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/export-commands.mjsView on unpkg

scripts/gen-catalog.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. k += `\n`; } if (others.length) { sk += `## skills\n\n| skill | what it does |\n|---|---|\n`; for (const s of others) sk += `| \`${s.name}\` | ${firstsentence(s.description)} |\n`; sk += `\n`; } sk += `## share a skill\n\npush a skill to the team brain so teammates can pull it:\n\n` + "```bash\naios push skill <name> # share skill.md + its reference files\naios pull skill <name> # fetch a shared skill into 1-inbox/from-brain/skills/\naios install-skill <name> # promote a pulled skill into .claude/skills/ (explicit, append-only)\n```\n\n" + `pulled skills are executable code — install is always a deliberate act; they never auto-activate

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/gen-catalog.mjsView on unpkg

hooks/aios-sync-nudge.shView file

•path = hooks/aios-sync-nudge.sh kind = build_helper sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/aios-sync-nudge.shView on unpkg

scaffold/.claude/descriptors/skills/slack-personal/slack.pyView file

•path = scaffold/.claude/descriptors/skills/slack-personal/slack.py kind = payload_in_excluded_dir sizeBytes = 41093 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scaffold/.claude/descriptors/skills/slack-personal/slack.pyView on unpkg

hooks/claim-check-guard.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/claim-check-guard.mjs#virtual:normalized:round1View on unpkg