Loading npm security reports…

@aisystemresources/emdee@0.24.3: AI-agent control-surface risk | LPM Firewall

registry / @aisystemresources/emdee / 0.24.3

@aisystemresources/emdee@0.24.3

Local-first document management with markdown rendering, knowledge graph, and MCP server.

AI Security Review

scanned 13d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the postinstall hook writes this package's skill markdown into the user-level Claude Code skills directory. The write is on by default and is not limited to a global install.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install or any install that runs the package postinstall script.

Impact

Claude Code loads attacker-chosen skill instructions from the user's home skills directory without a separate consent prompt.

Mechanism

scripts/postinstall.mjs spawnSyncs node on dist/cli/skills-install.js, which mkdir and copyFile package skills into os.homedir()/.claude/skills unless EMDEE_SKIP_POSTINSTALL is 1.

Policy narrative

Installing the package runs postinstall, which launches the bundled skills installer. That installer creates ~/.claude/skills if needed and copies the package skill markdown there, overwriting existing names. Claude Code treats that directory as its skill control surface, so the install changes agent behavior without a user command. Setting EMDEE_SKIP_POSTINSTALL=1 is the only gate, and it is off by default.

AI rationale

The install hook unconditionally mutates Claude Code's user-level skills directory, a foreign agent control surface, unless an opt-out variable is already set. The copied content is this package's own skills, but the write itself is unconsented and broad.

Evidence

package.jsonscripts/postinstall.mjsdist/cli/skills-install.js~/.claude/skills

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emdee.jsView file

2import { Command } from "commander"; L3: import { spawn, spawnSync } from "node:child_process"; L4: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/emdee.jsView on unpkg · L2

273const docs = path.resolve(process.cwd(), opts.docs); L274: const child = spawn("npx", ["vite", "--port", opts.port], { L275: cwd: pkgRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/emdee.jsView on unpkg · L273

dist/mcp/server.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/mcp/server.jsView on unpkg

18function adminClient() { L19: const key = process.env.SUPABASE_SECRET_KEY ?? process.env.SUPABASE_SERVICE_ROLE_KEY; L20: return createClient( ... L1114: const admin = adminClient(); L1115: const { data: direct } = await admin.from("doc_shares").select("id, share_root").eq("grantee_id", granteeId).eq("owner_id", ownerId).eq("path_prefix", relPath).eq("permission", "wr... L1116: if (direct && isWithinShareRootBoundary(relPath, direct.share_root)) return true; ... L1895: { "name": "get_image", "description": "Fetch an image from the vault and return it as a visual content block so you can see and analyze it. Use this to label images (patch_preamble... L1896: { "name": "upload_image", "description": "Upload an image (jpg/png/gif/webp/svg) as base64 to the vault. Creates a markdown doc tha

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/mcp/server.jsView on unpkg · L18

dist/cli/auth-commands.jsView file

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

dist/cli/auth-commands.jsView on unpkg · L6

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; ... L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/auth-commands.jsView on unpkg · L6

6import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L7: import { createServer } from "node:http"; L8: import { spawn } from "node:child_process"; L9: import path from "node:path"; L10: import os from "node:os"; L11: var CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L12: var CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L13: var DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L14: var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3; ... L20: }; L21: function base64url(buf) { L22: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

src/cli/auth.tsView file

12import { readFile, writeFile, mkdir, unlink, chmod, stat } from "node:fs/promises"; L13: import { createServer, type Server } from "node:http"; L14: import { spawn } from "node:child_process"; L15: import path from "node:path"; ... L17: L18: const CREDS_DIR = path.join(os.homedir(), ".config", "emdee"); L19: const CREDS_PATH = path.join(CREDS_DIR, "credentials.json"); L20: export const DEFAULT_HOST = process.env.EMDEE_CLOUD_URL ?? "https://emdee.tech"; L21: const LOGIN_TIMEOUT_MS = 5 * 60 * 1000; ... L37: // PKCE helpers per RFC 7636. L38: function base64url(buf: Buffer): string { L39: return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/cli/auth.tsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @aisystemresources/emdee@0.21.1 matchedPath = src/cli/auth.ts matchedIdentity = npm:[redacted]:0.21.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/cli/auth.tsView on unpkg

dist/cli/skills-install.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: import { readdir, mkdir, copyfile, stat } from "node:fs/promises"; import { parseargs } from "node:util"; import path from "node:path"; import os from "node:os"; import { fileurltopath } from "node:url"; var default_target = path.join(os.homedir(), ".claude", "skills"); var pkg_root = path.resolve(path.dirname(fileurltopath(import.meta.url)), "..", ".."); var skills_src = path.join(pkg_root, "skills"); async function copydirrecursive(srcdir, destdir) { await mkdir(destdir, { recursive: true }); const entries = await readdir(srcdir, { withfiletypes: true }); let count = 0; for (const entry of entries) { const srcpath = path.join(srcdir, entry.name); const destpath = path.join(destdir,

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/skills-install.jsView on unpkg