Loading npm security reports…

@aisystemresources/emdee@0.21.1: AI-agent control-surface risk | LPM Firewall

registry / @aisystemresources/emdee / 0.21.1

@aisystemresources/emdee@0.21.1

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall runs a skills copier that writes package markdown into Claude Code's user-global skills directory. That directory is a foreign agent control surface and is mutated without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install of this package, including a global or dependency install, unless EMDEE_SKIP_POSTINSTALL=1.

Impact

Claude Code can load package-authored skills in later sessions, including overwriting existing skill files in that global directory.

Mechanism

postinstall spawn of skills-install copying markdown into ~/.claude/skills

Policy narrative

On npm install, postinstall runs dist/cli/skills-install.js unless EMDEE_SKIP_POSTINSTALL=1. That copier writes packaged skill markdown into ~/.claude/skills and overwrites files already there. Claude Code loads those files as agent instructions, so any install of this package, including as a dependency, injects package-authored behavior into a foreign agent without an explicit skills-install or plugin-install command. An environment opt-out is not install-time consent.

AI rationale

The published postinstall hook copies skill files into ~/.claude/skills, Claude Code's user-global agent control surface, without an explicit user command. That is unconsented install-time mutation of a foreign AI-agent control surface and should be blocked.

Evidence

package.jsonscripts/postinstall.mjssrc/cli/skills-install.tsdist/cli/skills-install.js~/.claude/skills/

Decision evidence

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aisystemresources/emdee@0.20.5 matchedIdentity = npm:[redacted]:0.20.5 similarity = 0.736 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/emdee.jsView on unpkg

2import { Command } from "commander"; L3: import { spawn, spawnSync } from "node:child_process"; L4: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

273const docs = path.resolve(process.cwd(), opts.docs); L274: const child = spawn("npx", ["vite", "--port", opts.port], { L275: cwd: pkgRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/emdee.jsView on unpkg · L273

dist/cli/auth-commands.jsView file

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/cli/auth-commands.jsView on unpkg · L6

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; ... L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/auth-commands.jsView on unpkg · L6

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

src/cli/auth.tsView file

12import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L13: import { createServer, type Server } from "node:http"; L14: import { spawn } from "node:child_process"; L15: import path from "node:path"; ... L17: L18: const CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L19: const CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L20: export const DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L21: const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; ... L37: // PKCE helpers per RFC 7636. L38: function base64url(buf: Buffer): string { L39: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/auth.tsView on unpkg · L12

dist/cli/skills-install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { readdir, mkdir, copyfile, stat } from "node:fs/promises"; import { parseargs } from "node:util"; import path from "node:path"; import os from "node:os"; import { fileurltopath } from "node:url"; var default_target = path.join(os.homedir(), ".claude", "skills"); var pkg_root = path.resolve(path.dirname(fileurltopath(import.meta.url)), "..", ".."); var skills_src = path.join(pkg_root, "skills"); async function copydirrecursive(srcdir, destdir) { await mkdir(destdir, { recursive: true }); const entries = await readdir(srcdir, { withfiletypes: true }); let count = 0; for (const entry of entries) { const srcpath = path.join(srcdir, entry.name); const destpath = path.join(destdir,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/skills-install.jsView on unpkg

dist/mcp/server.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import { spawn, spawnSync } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

5import { mkdir, writeFile, access, readFile } from "node:fs/promises";

6import { createRequire } from "node:module";

7import readline from "node:readline/promises";

8import path from "node:path";

9import os from "node:os";

10import { fileURLToPath } from "node:url";

11

12const __dirname = path.dirname(fileURLToPath(import.meta.url));

13const pkgRoot = path.resolve(__dirname, "..");

14// SPR-226 followup: preserve the original user cwd across dispatcher

15// hops. `emdee delegate` spawns delegate-command.ts with cwd=pkgRoot

16// (dispatchers resolve their siblings from there), which then

17// re-spawns `emdee worktree`. Without this sentinel the second

18// bin/emdee.js sees process.cwd()=pkgRoot and worktree's git checks

19// fail in the npm install path instead of the user's actual repo.

20// Set once at the outermost invocation; nested spawns inherit via env.

21if (!process.env.EMDEE_USER_CWD) {

22 process.env.EMDEE_USER_CWD = process.cwd();

Lines 253-293javascript

253 await mkdir(cfgDir, { recursive: true });

254 await writeFile(cfgPath, JSON.stringify({

255 default_author: slug,

256 default_mode: opts.remoteMode,

257 }, null, 2) + "

•matchType = previous_version_dangerous_delta matchedPackage = @aisystemresources/emdee@0.20.5 matchedIdentity = npm:[redacted]:0.20.5 similarity = 0.736 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/emdee.jsView on unpkg

dist/cli/auth-commands.jsView file

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/cli/auth-commands.jsView on unpkg · L6

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; ... L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/auth-commands.jsView on unpkg · L6

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

src/cli/auth.tsView file

12import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L13: import { createServer, type Server } from "node:http"; L14: import { spawn } from "node:child_process"; L15: import path from "node:path"; ... L17: L18: const CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L19: const CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L20: export const DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L21: const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; ... L37: // PKCE helpers per RFC 7636. L38: function base64url(buf: Buffer): string { L39: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/auth.tsView on unpkg · L12

dist/cli/skills-install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { readdir, mkdir, copyfile, stat } from "node:fs/promises"; import { parseargs } from "node:util"; import path from "node:path"; import os from "node:os"; import { fileurltopath } from "node:url"; var default_target = path.join(os.homedir(), ".claude", "skills"); var pkg_root = path.resolve(path.dirname(fileurltopath(import.meta.url)), "..", ".."); var skills_src = path.join(pkg_root, "skills"); async function copydirrecursive(srcdir, destdir) { await mkdir(destdir, { recursive: true }); const entries = await readdir(srcdir, { withfiletypes: true }); let count = 0; for (const entry of entries) { const srcpath = path.join(srcdir, entry.name); const destpath = path.join(destdir,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/skills-install.jsView on unpkg

dist/mcp/server.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg