registry / @aishelf/service / 1.0.5

@aishelf/service@1.0.5

AIShelf local service for cross-platform file access

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious install-time behavior was found, but the local service exposes an unauthenticated raw file endpoint for its own ~/.aishelf data with wildcard CORS. If the service is running and authenticated, a web page could read the stored AIShelf/GitHub token from the local service.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs aishelf service start or installs/starts the native service, then visits attacker-controlled web content.

Impact

possible local AIShelf config and stored token disclosure from ~/.aishelf

Mechanism

unauthenticated local HTTP file read with wildcard CORS

Rationale

Static inspection shows a serious local-service exposure, but no unconsented lifecycle execution, stealth persistence, foreign AI-agent control mutation, obfuscation, or direct attacker exfiltration. Treat as a warning-worthy critical vulnerability rather than malicious package behavior.

Evidence

package.jsonREADME.mddist/server.jsdist/cli.js~/.aishelf/storage/config.json~/.aishelf/service.pid~/.aishelf/storage/registries~/.aishelf/storage/drafts~/.aishelf/storage/logs

Network endpoints4

kml6nyj2ad.execute-api.us-east-1.amazonaws.comgithub.comaishelf.devlocalhost:5314

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

dist/server.js starts local Express service on port 5314 with CORS Access-Control-Allow-Origin '*'.
dist/server.js exposes unauthenticated GET /raw/* mapped to AISHELF_ROOT via filesystemService.read.
dist/server.js stores auth token in ~/.aishelf/storage/config.json and /raw/storage/config.json would be readable while service runs.
dist/server.js sends bearer token to package backend and GitHub APIs; token is package-aligned but sensitive.
dist/cli.js can install a native OS service, but only via explicit aishelf service install with confirmation.

Evidence against

package.json has no preinstall/install/postinstall hook; only prepublishOnly build hook.
CLI service start/install is user-invoked, not automatic at npm install or import time.
No obfuscated payloads or prompt/reviewer manipulation found in package files.
child_process use is limited to starting server/docker checks and git diff in local draft comparison.
Filesystem writes are under ~/.aishelf storage/registries/drafts or user-selected registry resources.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 252 KB of source, external domains: aishelf.dev, github.com, kml6nyj2ad.execute-api.us-east-1.amazonaws.com, support.claude.com

Source & flagged code

3 flagged

dist/server.jsView file

Lines 2100-2140javascript

2100 const response = {

2101 success: true,

2102 data: {}

2103 };

2104 res.json(response);

2105 } catch (error) {

2106 next(error);

2107 }

2108 }

2109};

2110

2111// src/routes/resource.routes.ts

2112var import_express5 = require("express");

2113

2114// src/modules/resource/resource.service.ts

2115var import_path9 = __toESM(require("path"));

2116var import_promises6 = __toESM(require("fs/promises"));

2117

2118// src/modules/draft/draft.service.ts

2119var import_path7 = __toESM(require("path"));

2120var import_promises4 = __toESM(require("fs/promises"));

2121var import_child_process = require("child_process");

2122var import_util = require("util");

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L2120

2123

2124// src/config/resource.config.ts

2125var resource_config_exports = {};

2126__export(resource_config_exports, {

2127 ResourcePathHelper: () => ResourcePathHelper

2128});

2129var import_path6 = __toESM(require("path"));

2130__reExport(resource_config_exports, __toESM(require_dist()));

2131var import_shared19 = __toESM(require_dist());

2132var ResourcePathHelper = class {

2133 /**

2134 * Check if a resource type is stored as a folder

2135 */

2136 static isFolder(resourceType) {

2137 return (0, import_shared19.getResourceStorageType)(resourceType) === import_shared19.ResourceStorageType.FOLDER;

2138 }

2139 /**

2140 * Get the file name for a resource (e.g., "my-workflow.md" for workflows, "my-skill" for skills)

dist/cli.jsView file

Lines 126-166javascript

126

127// ../shared/dist/templates/skillTemplate.js

128var require_skillTemplate = __commonJS({

129 "../shared/dist/templates/skillTemplate.js"(exports2) {

130 "use strict";

131 Object.defineProperty(exports2, "__esModule", { value: true });

132 exports2.default = getTemplate;

Source & flagged code

3 flagged · loading source

dist/server.jsView file

2120var import_promises4 = __toESM(require("fs/promises")); L2121: var import_child_process = require("child_process"); L2122: var import_util = require("util");

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L2120

dist/cli.jsView file

3729if (await isDockerManaged()) { L3730: console.log("Service is already running via Docker on http://localhost:5314"); L3731: console.log("To stop it: docker stop aishelf-service"); ... L3737: console.log("Starting AIShelf service..."); L3738: const child = (0, import_child_process2.spawn)(process.execPath, [__filename.replace("cli.js", "server.js")], { L3739: detached: true, L3740: stdio: "ignore", L3741: env: { ...process.env } L3742: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L3729

146Cross-file remote execution chain: dist/cli.js spawns dist/server.js; helper contains network access plus dynamic code execution. L146: **Option 1: Use AI to help you** L147: - Add this skill to your AI model: https://github.[redacted]-creator/SKILL.md L148: - Ask your AI to help create the skill based on your requirements ... L426: var import_commander = require("commander"); L427: var import_child_process2 = require("child_process"); L428: var import_promises8 = __toESM(require("fs/promises")); ... L450: var PORT = 5314; L451: var AISHELF_ROOT = import_path.default.join(import_os.default.homedir(), ".aishelf"); L452: var PID_FILE = import_path.default.join(AISHELF_ROOT, "service.pid"); ... L484: headers: requestHeaders, L485: body: body ? JSON.stringify(body) : void 0 L486: });

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L146

Findings

3 High2 Medium5 Low

HighChild Processdist/server.js

HighSame File Env Network Executiondist/cli.js

HighCross File Remote Execution Contextdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/server.jsView file

Lines 2100-2140javascript

2100 const response = {

2101 success: true,

2102 data: {}

2103 };

2104 res.json(response);

2105 } catch (error) {

2106 next(error);

2107 }

2108 }

2109};

2110

2111// src/routes/resource.routes.ts

2112var import_express5 = require("express");

2113

2114// src/modules/resource/resource.service.ts

2115var import_path9 = __toESM(require("path"));

2116var import_promises6 = __toESM(require("fs/promises"));

2117

2118// src/modules/draft/draft.service.ts

2119var import_path7 = __toESM(require("path"));

2120var import_promises4 = __toESM(require("fs/promises"));

2121var import_child_process = require("child_process");

2122var import_util = require("util");

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L2120

2123

2124// src/config/resource.config.ts

2125var resource_config_exports = {};

2126__export(resource_config_exports, {

2127 ResourcePathHelper: () => ResourcePathHelper

2128});

2129var import_path6 = __toESM(require("path"));

2130__reExport(resource_config_exports, __toESM(require_dist()));

2131var import_shared19 = __toESM(require_dist());

2132var ResourcePathHelper = class {

2133 /**

2134 * Check if a resource type is stored as a folder

2135 */

2136 static isFolder(resourceType) {

2137 return (0, import_shared19.getResourceStorageType)(resourceType) === import_shared19.ResourceStorageType.FOLDER;

2138 }

2139 /**

2140 * Get the file name for a resource (e.g., "my-workflow.md" for workflows, "my-skill" for skills)

dist/cli.jsView file

Lines 126-166javascript

126

127// ../shared/dist/templates/skillTemplate.js

128var require_skillTemplate = __commonJS({

129 "../shared/dist/templates/skillTemplate.js"(exports2) {

130 "use strict";

131 Object.defineProperty(exports2, "__esModule", { value: true });

132 exports2.default = getTemplate;

Lines 3709-3749javascript

3709 req.destroy();

3710 resolve(false);

3711 });

3712 });

3713}

3714async function isDockerManaged() {

3715 return new Promise((resolve) => {

3716 const proc = (0, import_child_process2.spawn)("docker", ["ps", "--filter", "name=aishelf-service", "--format", "{{.Names}}"], {

3717 stdio: ["ignore", "pipe", "ignore"]

3718 });

3719 let output = "";

3720 proc.stdout.on("data", (chunk) => {

3721 output += chunk.toString();

3722 });

3723 proc.on("close", () => resolve(output.trim().length > 0));

3724 proc.on("error", () => resolve(false));

3725 });

3726}

3727async function start() {

3728 if (await isHealthy()) {

3729 if (await isDockerManaged()) {

3730 console.log("Service is already running via Docker on http://localhost:5314");

3731 console.log("To stop it: docker stop aishelf-service");

3732 } else {

3733 console.log("Service is already running on http://localhost:5314");

3734 }

3735 return;

3736 }

3737 console.log("Starting AIShelf service...");

3738 const child = (0, import_child_process2.spawn)(process.execPath, [__filename.replace("cli.js", "server.js")], {

3739 detached: true,

3740 stdio: "ignore",

3741 env: { ...process.env }

3742 });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L3729

3743 if (!child.pid) {

3744 console.log("Failed to start service");

3745 process.exit(1);

3746 }

3747 child.unref();

3748 for (let i = 0; i < 10; i++) {

3749 await new Promise((resolve) => setTimeout(resolve, 300));