registry / @aiscene/aiserver / 2.0.4

@aiscene/aiserver@2.0.4

AI automation server with device management, task scheduling, and debug capabilities

AI Security Review

scanned 18d ago · by lpm-firewall-ai

At runtime, the server polls a configured control-plane endpoint and executes received automation tasks. Its persistent browser RPC channel can also run supplied JavaScript in browser pages.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the aiserver CLI and completes or has saved node authorization.

Impact

A controlling or compromised configured backend can cause arbitrary code execution in the server process and JavaScript execution in browser contexts.

Mechanism

remote task and browser-command execution via dynamic JavaScript compilation

Rationale

The package is not demonstrated malware, but it exposes intentional remote dynamic-code and browser-control capability plus a bundled credential. Warn so the capability receives review without treating normal installation as malicious.

Evidence

package.jsondist/index.jsdist/task/poller.jsdist/executor/code-executor.jsdist/task/guada-browser-rpc-client.jsdist/config/index.jsdata/aiserver-auth.jsondata/aiserver.db~/.aiserver/guada-browser-profile

Network endpoints3

opentestai.jd.com/rest/execution-queue/tasks/nextws://clawai.jd.com/api/v1/browser-rpc/ws

@aiscene/aiserver@2.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code