Loading npm security reports…

@aiscene/aiserver@2.1.0: Malicious npm security report (Block) | LPM Firewall

registry / @aiscene/aiserver / 2.1.0

@aiscene/aiserver@2.1.0

AI automation server with device management, task scheduling, and debug capabilities

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Running the CLI starts a persistent WebSocket client to the configured backend. The backend can request local file, Git, browser, and page-script operations, and receives their results.

Static reason

One or more suspicious static signals were detected.

Trigger

A user runs aiserver after its browser authorization flow completes.

Impact

A backend or intercepted endpoint can collect accessible local source and file contents and control browser sessions.

Mechanism

Remote WebSocket command execution with arbitrary local-directory selection and file-result return.

Attack narrative

On normal startup, the package enables a reconnecting browser-RPC WebSocket client. It accepts command messages and returns their execution results. The command set delegates to a local code service that permits an endpoint to choose any existing directory, then read files within it, search source, and obtain Git data. The same channel controls browser sessions and can execute supplied JavaScript in pages. This creates a concrete remote data-exfiltration and browser-control path rather than merely exposing a local automation API.

AI rationale

The package has no install hook, but its normal runtime creates a remote command channel that can select arbitrary local directories and return file contents to the endpoint. That is concrete remote data-exfiltration capability with insufficient local path or command authorization controls.

Evidence

dist/task/guada-browser-rpc-client.jsdist/task/local-code-service.jsdata/aiserver-auth.jsondist/.env

Network endpoints1

Source & flagged code

6 flagged · loading source

dist/.envView file

32patternName = blocked_file severity = critical blockedFile = dist/.env redactedSecretContext = secretLikeLines = 4 L32: OPENAI_API_KEY=<redacted:0 empty> L47: MIDSCENE_MODEL_API_KEY=<redacted:39 token-like> L48: MIDSCENE_MODEL_NAME=<redacted:29 token-like> L49: MIDSCENE_MODEL_FAMILY=<redacted:22 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/task/guada-browser-rpc-client.jsView file

35async execute(method, params = {}) { if (localCodeService.canHandle(method)) { logger.info(`Delegating browser RPC command to local code service: ${method}`); return localCodeService.execute(method, params); } if (chromeConnectorServer.canHandle(method, params)) { logger.info(`Delegating browser RPC command to Chrome connector: ${method}`); return chromeConnectorServer.execute(method, params); }

High

Ai Review Evidence

The remote command dispatcher exposes local-project, Git, search, and file-reading operations.

dist/task/guada-browser-rpc-client.jsView on unpkg · L35

291const result = await record.page.evaluate(async (code) => { L292: const fn = new Function(`return (async () => { ${code} })();`); L293: return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/task/guada-browser-rpc-client.jsView on unpkg · L291

dist/task/local-code-service.jsView file

306async readFile(params) { const project = await this.resolveProject(params); const rawFilePath = String(params.filePath || params.file_path || ''); if (!rawFilePath.trim()) throw new Error('file_path is required'); const filePath = await this.resolveFileInProject(project, rawFilePath); const content = await this.readSmallTextFile(filePath, Math.min(numberValue(params.maxBytes || params.max_bytes, 120000), 500000));

High

Ai Review Evidence

A remote command may open any existing directory by absolute path; subsequent file reads return the selected file content.

dist/task/local-code-service.jsView on unpkg · L306

1import { execFile } from 'child_process'; L2: import { createHash } from 'crypto'; ... L118: function truncateText(value, maxBytes) { L119: const buffer = Buffer.from(value); L120: if (buffer.byteLength <= maxBytes) ... L663: async gitOutput(rootPath, args, maxBuffer = 1024 * 1024) { L664: const { stdout } = await execFileAsync('git', ['-C', rootPath, ...args], { L665: timeout: 30000, L666: maxBuffer, L667: env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, L668: }); ... L864: if (['.java', '.kt', '.cs'].includes(ext)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/task/local-code-service.jsView on unpkg · L1

dist/executor/ios-wda-manager.jsView file

1import { spawn } from 'child_process'; L2: import fs from 'fs'; L3: import net from 'net'; L4: import os from 'os'; ... L53: try { L54: const { stdout } = await execFileText(findExecutable('idevice_id'), ['-l'], 10_000); L55: return stdout ... L118: this.log = options.log || (() => undefined); L119: const logDir = path.join(process.cwd(), 'logs'); L120: fs.mkdirSync(logDir, { recursive: true }); ... L181: }); L182: child.stdin.end();

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

dist/executor/ios-wda-manager.jsView on unpkg · L1

Source & flagged code

6 flagged

dist/.envView file

Lines 12-49text

12AISERVER_TASK_POLL_INTERVAL=3000

13AISERVER_TASK_API_URL=http://nethp-test.jd.com

14AISERVER_TASK_MAX_CONCURRENT=3

15AISERVER_TASK_TIMEOUT=1200000

16

17# Node

18AISERVER_NODE_PORT=8002

19AISERVER_NODE_TYPE=executor

20AISERVER_NODE_VERSION=1.0.0

21AISERVER_NODE_ENVIRONMENT=prod

22AISERVER_NODE_WEIGHT=1

23AISERVER_NODE_SUPPORTED_TAGS=android,ios,web

24AISERVER_NODE_REGION=

25AISERVER_NODE_DESCRIPTION=

26AISERVER_NODE_REGISTER_URL=http://nethp-test.jd.com/rest/execution-nodes/register

27AISERVER_NODE_HEARTBEAT_URL=http://nethp-test.jd.com/rest/execution-nodes/heartbeat

28AISERVER_NODE_HEARTBEAT_INTERVAL=30000

29

30# AI

31OPENAI_BASE_URL=

32OPENAI_API_KEY=

33MIDSCENE_MODEL_NAME=

34MIDSCENE_USE_QWEN3_VL=1

35

36# Storage

37AISERVER_DB_PATH=./data/aiserver.db

38

39# Callback

40AISERVER_STATUS_UPDATE_URL=http://nethp-test.jd.com/rest/execution-queue/tasks

41AISERVER_REPORT_UPLOAD_URL=http://nethp-test.jd.com/rest/execution-callback/result-file

42AISERVER_DEVICE_HEARTBEAT_URL=http://nethp-test.jd.com/rest/mobile-devices/heartbeat

43AISERVER_DEVICE_STATUS_UPDATE_URL=http://nethp-test.jd.com/rest/mobile-devices

44

45

46MIDSCENE_MODEL_BASE_URL=https://modelservice.jdcloud.com/v1

47MIDSCENE_MODEL_API_KEY=pk-485b2b56-7334-4bed-bd74-09bb42ca3baf

48MIDSCENE_MODEL_NAME=doubao-seed-1-6-vision-250815

49MIDSCENE_MODEL_FAMILY=vlm-ui-tars-doubao-1.5

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/task/guada-browser-rpc-client.jsView file

Lines 15-55javascript

15 return trimmed;

16}

17function getLocalIPs() {

18 const interfaces = os.networkInterfaces();

19 const addresses

dist/task/local-code-service.jsView file

Lines 1-21javascript

1import { execFile } from 'child_process';

2import { createHash } from 'crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/task/local-code-service.jsView on unpkg · L1

3import fs from 'fs/promises';

4

dist/executor/ios-wda-manager.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import fs from 'fs';

3import net from 'net';

4import os from 'os';

Lines 271-311javascript

271 }

272 async click(params) {

273 const record = this.getWindow(params.window_id || params.windowId);

274 if (!params.selector)

275 throw new Error('selector is required');

276 await record.page.click(params.selector, { timeout: 15000 });

277 await record.page.waitForLoadState('domcontentloaded', { timeout: 10000 }).catch(() => undefined);

278 return this.pageBasicResult(record.page, record.id);

279 }

280 async input(params) {

281 const record = this.getWindow(params.window_id || params.windowId);

282 if (!params.selector)

283 throw new Error('selector is required');

284 await record.page.fill(params.selector, String(params.value ?? ''), { timeout: 15000 });

285 return this.pageBasicResult(record.page, record.id);

286 }

287 async runJs(params) {

288 const record = this.getWindow(params.window_id || params.windowId);

289 if (!params.code)

290 throw new Error('code is required');

291 const result = await record.page.evaluate(async (code) => {

292 const fn = new Function(`return (async () => { ${code} })();`);

293 return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/task/guada-browser-rpc-client.jsView on unpkg · L291

294 }, String(params.code));

295 return {

296 success: true,

297 windowId: record.id,

298 window_id: record.id,

299 result,

300 };

301 }

302 async listWindows(params) {

303 const sessionId = params.session_id || params.sessionId;

304 const windows = await Promise.all(Array.from(this.windows.values())

305 .filter((record) => !sessionId || record.sessionId === sessionId)

306 .map(async (record) => ({

307 windowId: record.id,

308 window_id: record.id,

309 title: await record.page.title().catch(() => ''),

310 url: record.page.url(),

311 shared: record.shared,

Lines 286-326javascript

286 continue;

287 results.push({

288 filePath: toPosix(path.relative(project.rootPath, filePath)),

289 file_path: toPosix(path.relative(project.rootPath, filePath)),

290 line: index + 1,

291 snippet: line.trim().slice(0, 500),

292 });

293 }

294 }

295 return {

296 success: true,

297 projectId: project.id,

298 project_id: project.id,

299 query,

300 type,

301 total: results.length,

302 truncated: results.length >= maxResults,

303 results,

304 };

305 }

306 async readFile(params) {

307 const project = await this.resolveProject(params);

308 const rawFilePath = String(params.filePath || params.file_path || '');

309 if (!rawFilePath.trim())

310 throw new Error('file_path is required');

311 const filePath = await this.resolveFileInProject(project, rawFilePath);

312 const content = await this.readSmallTextFile(filePath, Math.min(numberValue(params.maxBytes || params.max_bytes, 120000), 500000));

High

Ai Review Evidence

A remote command may open any existing directory by absolute path; subsequent file reads return the selected file content.

dist/task/local-code-service.jsView on unpkg · L306

313 const lines = content.split(/\r?\n/);

314 const startLine = Math.max(1, numberValue(params.startLine || params.start_line, 1));

315 const endLine = Math.min(lines.length, numberValue(params.endLine || params.end_line, params.startLine || params.start_line ? startLine + 220 : lines.length));

316 const selected = lines.slice(startLine - 1, endLine);

317 return {

318 success: true,

319 projectId: project.id,

320 project_id: project.id,

321 filePath: toPosix(path.relative(project.rootPath, filePath)),

322 file_path: toPosix(path.relative(project.rootPath, filePath)),

323 absolutePath: filePath,

324 absolute_path: filePath,

325 startLine,

326 start_line: startLine,