@aiscene/aiserver@2.0.1: Suspicious npm security report (Warn)

AI Security Review

scanned 5h ago · by lpm-firewall-ai

The runtime opens an unauthenticated control WebSocket on all interfaces and supports code execution requests. A reachable client can submit JavaScript that the process compiles and executes.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run the aiserver CLI; a network client connects to the debug WebSocket and sends a runCode action.

Impact

Remote code execution with the privileges of the aiserver process.

Mechanism

Unauthenticated WebSocket-controlled AsyncFunction execution

Rationale

This is a concrete critical remote-code-execution vulnerability in a declared automation server, not evidence of covert malicious intent. No install-time execution or stealth/exfiltration chain was found.

Evidence

package.jsondist/index.jsdist/config/index.jsdist/debug/websocket-server.jsdist/executor/code-executor.jsdist/executor/cli-executor.jsdist/task/poller.jsdist/.env

Network endpoints5

ws://0.0.0.0:8002opentestai.jd.comopentest.jd.comclawai.jd.commodelservice.jdcloud.com/v1

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/debug/websocket-server.js binds a control WebSocket to 0.0.0.0 with no authentication check.
dist/debug/websocket-server.js accepts runCode debug actions from WebSocket messages.
dist/executor/code-executor.js compiles supplied code with AsyncFunction.
dist/executor/cli-executor.js also runs task-supplied runCode via AsyncFunction.
dist/config/index.js includes a default model API key.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
Execution starts only when the aiserver CLI is run.
Task polling, report uploads, and device control match the declared automation-server purpose.
No hidden payload download, credential harvesting, or foreign AI-agent configuration writes found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

2 flagged

dist/.envView file

32patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L32: OPENAI_API_KEY=<redacted:0 empty> L47: MIDSCENE_MODEL_API_KEY=<redacted:39 token-like> L48: MIDSCENE_MODEL_NAME=<redacted:29 token-like> L49: MIDSCENE_MODEL_FAMILY=<redacted:22 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/debug/websocket-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aiscene/aiserver@1.9.7 matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:1.9.7 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/debug/websocket-server.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/.envView file

32patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 4 L32: OPENAI_API_KEY=<redacted:0 empty> L47: MIDSCENE_MODEL_API_KEY=<redacted:39 token-like> L48: MIDSCENE_MODEL_NAME=<redacted:29 token-like> L49: MIDSCENE_MODEL_FAMILY=<redacted:22 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/debug/websocket-server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aiscene/aiserver@1.9.7 matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:1.9.7 similarity = 0.815 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/debug/websocket-server.jsView on unpkg

Findings

1 Critical1 High2 Medium4 Low

CriticalCritical Secretdist/.env

HighPrevious Version Dangerous Deltadist/debug/websocket-server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings