Loading npm security reports…

@aisystemresources/emdee@0.13.3: AI-agent control-surface risk | LPM Firewall

registry / @aisystemresources/emdee / 0.13.3

@aisystemresources/emdee@0.13.3

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package runs a postinstall script that copies packaged skills into the user's Claude Code skills directory. This is an unconsented mutation of a broad AI-agent control surface and can overwrite matching existing skills.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install (including non-global installs) without EMDEE_SKIP_POSTINSTALL=1

Impact

Package-authored skills become available to Claude Code and existing matching skill files may be overwritten.

Mechanism

postinstall recursively copies package-controlled Markdown into ~/.claude/skills

Policy narrative

Installing the package invokes scripts/postinstall.mjs, which launches the bundled skills installer by default. That installer targets ~/.claude/skills and copies package-controlled Markdown skill files recursively, overwriting existing matching files. The behavior is not limited to a user-invoked setup command or verified global installation, so package installation mutates a foreign, behavior-bearing AI-agent directory.

Rationale

The confirmed postinstall mutation of ~/.claude/skills meets the policy threshold for an unconsented foreign/broad AI-agent control-surface write. The reverse-shell and credential-exfiltration hints were not confirmed in the inspected auth sources.

Evidence

package.jsonscripts/postinstall.mjssrc/cli/skills-install.tsdist/cli/skills-install.jsskills/~/.claude/skills/

Decision evidence

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

2import { Command } from "commander"; L3: import { spawn } from "node:child_process"; L4: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

173const docs = path.resolve(process.cwd(), opts.docs); L174: const child = spawn("npx", ["vite", "--port", opts.port], { L175: cwd: pkgRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/emdee.jsView on unpkg · L173

•matchType = normalized_sha256 matchedPackage = @aisystemresources/emdee@0.13.0 matchedPath = bin/emdee.js matchedIdentity = npm:[redacted]:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/emdee.jsView on unpkg

dist/cli/auth-commands.jsView file

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/cli/auth-commands.jsView on unpkg · L6

54const escaped = url.replace(/'/g, "''"); L55: return { cmd: "powershell", args: ["-NoProfile", "-Command", `Start-Process '${escaped}'`] }; L56: }

High

Shell

Package source references shell execution.

dist/cli/auth-commands.jsView on unpkg · L54

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; ... L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli/auth.tsView file

12import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L13: import { createServer, type Server } from "node:http"; L14: import { spawn } from "node:child_process"; L15: import path from "node:path"; ... L17: L18: const CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L19: const CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L20: export const DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L21: const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; ... L37: // PKCE helpers per RFC 7636. L38: function base64url(buf: Buffer): string { L39: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/auth.tsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @aisystemresources/emdee@0.13.0 matchedPath = src/cli/auth.ts matchedIdentity = npm:[redacted]:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli/auth.tsView on unpkg

dist/mcp/server.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: n2(tmpdir(), "emdee-dejavusans.ttf"); if (!existssync(dejavu_sans_path)) { writefilesync(dejavu_sans_path, buffer.from(dejavu_sans_ttf_base64, "base64")); } var package_default = { name: "@aisystemresources/emdee", version: "0.13.3", description: "local-first document management with markdown rendering, knowledge graph, and mcp server.", type: "module", repository: { type: "git", url: "git+https://github.com/aisystemresources/emdee.git" }, bin: { emdee: "bin/emdee.js" }, publishconfig: { access: "public" }, scripts: { dev: "next dev --webpack", build: "next build --webpack", start: "next start", lint: "eslint", mcp: "tsx src

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/mcp/server.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 10-50json

10 "bin": {

11 "emdee": "bin/emdee.js"

12 },

13 "publishConfig": {

14 "access": "public"

15 },

16 "scripts": {

17 "dev": "next dev --webpack",

18 "build": "next build --webpack",

19 "start": "next start",

20 "lint": "eslint",

21 "mcp": "tsx src/mcp/server.ts",

22 "typecheck": "tsc --noEmit",

23 "e2e": "playwright test",

24 "e2e:ui": "playwright test --ui",

25 "e2e:report": "playwright show-report",

26 "check:migrations": "node scripts/check-migration-drift.mjs",

27 "ci-package": "node scripts/verify-package.mjs",

28 "build:cli": "node scripts/build-cli.mjs",

29 "prepublishOnly": "node scripts/build-cli.mjs",

30 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 },

32 "files": [

33 "bin/",

34 "dist/",

35 "scripts/postinstall.mjs",

36 "src/cli/",

37 "src/core/",

38 "src/lib/cache/",

39 "src/lib/database/",

40 "src/lib/mcp/",

41 "src/lib/storage/",

42 "src/lib/supabase/",

43 "src/lib/trash/",

44 "src/lib/owner/",

45 "src/lib/system-nodes.ts",

46 "src/mcp/",

47 "skills/",

48 "templates/",

49 "seed-vault/",

50 ".claude-plugin/",

bin/emdee.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import { spawn } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

dist/cli/auth-commands.jsView file

Lines 1-26javascript

1// src/cli/auth-commands.ts

2import { parseArgs } from "node:util";

3

4// src/cli/auth.ts

5import { createHash, randomBytes } from "node:crypto";

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises";

src/cli/auth.tsView file

Lines 1-32typescript

1// SPRINT-091: CLI auth — PKCE loopback OAuth against emdee.tech.

2//

3// Follows RFC 8252 (OAuth 2.0 for native apps) + dynamic client registration

4// via /oauth/register (matches Codex + Claude Code patterns already in use).

5// Credentials land in ~/.config/emdee/credentials.json at 0600.

6//

7// Token has a 30-day TTL and there is no refresh grant on the server today,

8// so credentials are simple: access_token + client_id + host + saved_at. When

9// a token expires, the CLI surfaces `run 'emdee login'` — same UX as Codex.

10

dist/mcp/server.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: n2(tmpdir(), "emdee-dejavusans.ttf"); if (!existssync(dejavu_sans_path)) { writefilesync(dejavu_sans_path, buffer.from(dejavu_sans_ttf_base64, "base64")); } var package_default = { name: "@aisystemresources/emdee", version: "0.13.3", description: "local-first document management with markdown rendering, knowledge graph, and mcp server.", type: "module", repository: { type: "git", url: "git+https://github.com/aisystemresources/emdee.git" }, bin: { emdee: "bin/emdee.js" }, publishconfig: { access: "public" }, scripts: { dev: "next dev --webpack", build: "next build --webpack", start: "next start", lint: "eslint", mcp: "tsx src

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/mcp/server.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg