registry / @aisystemresources/emdee / 0.24.0

@aisystemresources/emdee@0.24.0

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Install automatically places this package's own Claude skills on a foreign agent surface, which is guarded first-party extension setup rather than a hidden takeover. OAuth stays bound to the host that issued the token, and the skill copy has an explicit opt-out.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install lifecycle postinstall, including installs that are not an explicit emdee skills-install command.

Impact

Claude Code can pick up Emdee skill instructions for later sessions without a separate user command. The written content stays within this package's skill files.

Mechanism

scripts/postinstall.mjs launches dist/cli/skills-install.js, which copies skills/*.md into ~/.claude/skills unless EMDEE_SKIP_POSTINSTALL=1.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsdist/cli/skills-install.js~/.claude/skills

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json registers a postinstall script that runs on npm install.
That script spawns dist/cli/skills-install.js unless EMDEE_SKIP_POSTINSTALL is set to 1.
skills-install copies this package's markdown skills into ~/.claude/skills by default, which Claude Code loads as agent instructions.

Evidence against

Copied files are this package's own vault-convention skills, and the installer does not rewrite Claude settings, hooks, or MCP config.
An environment opt-out skips the copy, and a failed copy does not fail the install.
Login stores an OAuth token and later sends it only to the host saved with that token, defaulting to https://emdee.tech.
The package does not depend on itself and has no hidden download or eval payload in the install path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

14 flagged

package.jsonView file

Lines 11-51json

11 "emdee": "bin/emdee.js"

12 },

13 "publishConfig": {

14 "access": "public"

15 },

16 "scripts": {

17 "dev": "next dev --webpack",

18 "build": "next build --webpack",

19 "start": "next start",

20 "lint": "eslint",

21 "mcp": "tsx src/mcp/server.ts",

22 "typecheck": "tsc --noEmit",

23 "test:context": "node --import tsx --test scripts/test-context-startup.ts scripts/test-context-tools.ts",

24 "e2e": "playwright test",

25 "e2e:ui": "playwright test --ui",

26 "e2e:report": "playwright show-report",

27 "check:migrations": "node scripts/check-migration-drift.mjs",

28 "ci-package": "node scripts/verify-package.mjs",

29 "build:cli": "node scripts/build-cli.mjs",

30 "prepublishOnly": "node scripts/build-cli.mjs",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test:access": "node --import tsx --test scripts/test-agent-access.ts scripts/test-oauth-consent.ts",

33 "test:knowledge": "node --import tsx --test scripts/test-knowledge.ts",

34 "benchmark:context": "node --import tsx scripts/benchmark-context.ts",

35 "test:discovery": "node --import tsx --test scripts/test-discovery.ts",

36 "test:discovery:database": "node --import tsx --test scripts/test-discovery-database.ts",

37 "verify:discovery:ui": "node scripts/discovery-ui-fixture.mjs"

38 },

39 "files": [

40 "bin/",

41 "dist/",

42 "scripts/postinstall.mjs",

43 "src/cli/",

44 "src/core/",

45 "src/lib/cache/",

46 "src/lib/discovery/",

47 "src/lib/database/",

48 "src/lib/mcp/",

49 "src/lib/storage/",

50 "src/lib/supabase/",

51 "src/lib/trash/",

bin/emdee.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { Command } from "commander";

3import { spawn, spawnSync } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

dist/mcp/server.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg

18function adminClient() { L19: const key = process.env.SUPABASE_SECRET_KEY ?? process.env.SUPABASE_SERVICE_ROLE_KEY; L20: return createClient( ... L532: throw new Error("Semantic search is not configured."); L533: const r = await fetch("https://api.openai.com/v1/embeddings", { L534: method: "POST", ... L538: }, L539: body: JSON.stringify({ L540: model: EMBEDDING_MODEL, ... L550: ); L551: const data = await r.json(); L552: if (!Array.isArray(data.data) || data.data.length !== inputs.length)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp/server.jsView on unpkg · L18

dist/cli/auth-commands.jsView file

Lines 1-26javascript

1// src/cli/auth-commands.ts

2import { parseArgs } from "node:util";

4// src/cli/auth.ts

5import { createHash, randomBytes } from "node:crypto";

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises";

src/cli/auth.tsView file

Lines 1-32typescript

1// SPRINT-091: CLI auth — PKCE loopback OAuth against emdee.tech.

2//

3// Follows RFC 8252 (OAuth 2.0 for native apps) + dynamic client registration

4// via /oauth/register (matches Codex + Claude Code patterns already in use).

5// Credentials land in ~/.config/emdee/credentials.json at 0600.

6//

7// Token has a 30-day TTL and there is no refresh grant on the server today,

8// so credentials are simple: access_token + client_id + host + saved_at. When

9// a token expires, the CLI surfaces `run 'emdee login'` — same UX as Codex.

dist/cli/skills-install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { readdir, mkdir, copyfile, stat } from "node:fs/promises"; import { parseargs } from "node:util"; import path from "node:path"; import os from "node:os"; import { fileurltopath } from "node:url"; var default_target = path.join(os.homedir(), ".claude", "skills"); var pkg_root = path.resolve(path.dirname(fileurltopath(import.meta.url)), "..", ".."); var skills_src = path.join(pkg_root, "skills"); async function copydirrecursive(srcdir, destdir) { await mkdir(destdir, { recursive: true }); const entries = await readdir(srcdir, { withfiletypes: true }); let count = 0; for (const entry of entries) { const srcpath = path.join(srcdir, entry.name); const destpath = path.join(destdir,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/skills-install.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aisystemresources/emdee@0.20.5 matchedIdentity = npm:[redacted]:0.20.5 similarity = 0.670 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/emdee.js

Findings

3 Critical9 High5 Medium8 Low

CriticalCredential Exfiltrationsrc/cli/auth.ts

CriticalReverse Shelldist/cli/auth-commands.js

CriticalPrevious Version Dangerous Deltabin/emdee.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/emdee.js

HighSame File Env Network Executiondist/cli/auth-commands.js

HighSandbox Evasion Gated Capabilitydist/cli/auth-commands.js

HighExternal Ai Agent Control Surface Mutationdist/cli/skills-install.js

HighRuntime Package Installbin/emdee.js

HighSemantic Analysis Limiteddist/mcp/server.js

HighKnown Malware Source Similaritydist/cli/auth-commands.js

Affected versions and remediation

This report applies to @aisystemresources/emdee@0.24.0.

See all versions of @aisystemresources/emdee for other recorded verdicts.

Review the evidence and your use of @aisystemresources/emdee@0.24.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 04:16:52.966Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.