@aitherium/awsh
awsh - your terminal answers you. Type a question where a command would go, and get an answer instead of "command not found".
This report shows the evidence for @aitherium/awsh@1.19.5. 2 of 10 known versions are blocked or flagged. The newest version, 1.19.7, is flagged. See all versions.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe automatic crash-report fallback can use the user's GitHub credentials to publish an issue to the publisher's repository, while non-TTY execution counts as consent by default. The report also sends identifying diagnostics without an affirmative choice on the TUI rejection path, so this meets the account-action rule for blocking.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An uncaught exception or unhandled rejection; non-TTY reporting assumes consent, and an active TUI submits unhandled rejections silently. GitHub issue creation occurs if the Genesis submission fails.
Impact
Crash details, command context, hostname, and machine information may be sent without an affirmative user request; the fallback can publish an issue using the user's local GitHub authentication.
Mechanism
The startup-installed crash reporter sends a formatted report to GENESIS_URL/feedback, then invokes gh issue create for Aitherium/AitherOS as a fallback.
Attack narrative
The CLI installs its crash reporter at startup. In non-interactive use it treats consent as granted, and the TUI silently submits some rejection reports. If the Genesis report fails, the handler uses the user's gh authentication to create an issue in Aitherium/AitherOS, a publisher-selected target, without an affirmative request.
AI rationale
The automatic crash-report fallback can use the user's GitHub credentials to publish an issue to the publisher's repository, while non-TTY execution counts as consent by default. The report also sends identifying diagnostics without an affirmative choice on the TUI rejection path, so this meets the account-action rule for blocking.
Evidence
dist/main.jsdist/crash-reporter.js
Network endpoints2
AITHER_GENESIS_URL/feedback (defaults to http://localhost:8001/feedback)GitHub CLI repository Aitherium/AitherOS
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The main CLI installs a global crash reporter at startup.
- When stdin is not a TTY, the report consent check returns true automatically.
- The crash handler tries the configured Genesis endpoint, then falls back to the GitHub CLI if that submission fails.
- The fallback creates an issue in the publisher-selected Aitherium/AitherOS repository using the user's local gh authentication.
- Crash reports contain the error message, stack, command context, hostname, and machine details.
- Unhandled rejections while the TUI is active are submitted silently without the consent check.
Evidence against
- The package is an Aitherium CLI, and crash reporting is presented as a debugging feature.
- In interactive terminals, the crash handler asks whether to send the report; the default endpoint is localhost unless AITHER_GENESIS_URL is set.
- The manifest has no install lifecycle script.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
12 flaggeddist/repl.jsView file
14import * as readline from 'node:readline';
L15: import { execSync } from 'node:child_process';
L16: import { existsSync, readFileSync, appendFileSync, mkdirSync } from 'node:fs';
High
702else if (!shellCmd) {
L703: console.log(chalk.yellow(' Usage: !command (run in PowerShell 7)'));
L704: console.log(chalk.dim(' !! repeats last shell command'));
High
808patternName = generic_password
severity = medium
line = 808
Medium
dist/crash-reporter.jsView file
Findings
1 Critical10 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/backend-resolver.js
HighChild Processdist/repl.js
HighShelldist/repl.js
HighSame File Env Network Executiondist/crash-reporter.js
HighCredential Exfiltrationdist/wallet-command.js
HighCredential Redirect Persistencedist/commands.js
HighCommand Output Exfiltrationdist/commands.js
HighSandbox Evasion Gated Capabilitydist/rc-command.js
HighTrigger Reachable Credential Exfiltrationdist/wallet-command.js
HighRuntime Package Installdist/backend-command.js#virtual:normalized:round1
HighSemantic Analysis Limiteddist/awconnect-command.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @aitherium/awsh@1.19.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing @aitherium/awsh@1.19.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.