registry / Data exfiltration / @alumbwe/anvil
@alumbwe/anvil
A Terminal User Interface (TUI) package built with OpenTUI and React.
This report shows the evidence for @alumbwe/anvil@1.0.36. 2 of 20 known versions are blocked or flagged. The newest version, 1.0.42, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains concrete runtime disclosure of chat content to an advertising endpoint and unexplained hidden logging. The lack of an install hook limits the scope, but does not remove the runtime data-exfiltration risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Run the CLI and send a chat message.
Impact
Private coding prompts and associated session information can be disclosed to an advertising service.
Mechanism
Advertising-payload exfiltration and hidden home-directory logging.
Attack narrative
After a user starts a chat, the ad feature collects assistant history and the latest user message, then posts it with a bearer token, session ID, and device data to an ads endpoint. Separately, successful and failed agent runs write metadata to a hidden home-directory debug log. These actions are not install-time, but they create an unnecessary disclosure channel for coding conversations.
AI rationale
The package contains concrete runtime disclosure of chat content to an advertising endpoint and unexplained hidden logging. The lack of an install hook limits the scope, but does not remove the runtime data-exfiltration risk.
Evidence
src/hooks/use-gravity-ad.tssrc/hooks/use-send-message.ts~/.anvil-token-debug.log
Network endpoints1
${WEBSITE_URL}/api/v1/ads
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- During ordinary chat, the ad hook adds the latest user message to an advertising payload.
- The hook sends conversation messages, session and device data, plus a bearer token to an ads endpoint.
- Each completed agent run appends metadata to a hidden file in the user's home directory.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The observed network and file actions occur only after the user runs the CLI and chats.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsTelemetryUrlStrings
NoLicense
Source & flagged code
16 flagged · loading sourcevendor/@anvil/common/src/types/spawn.tsView file
1import type { ChildProcess, SpawnOptions } from 'child_process'
L2:
High
Child Process
Package source references child process execution.
vendor/@anvil/common/src/types/spawn.tsView on unpkg · L1src/utils/open-file.tsView file
105const child = spawn(command, {
L106: shell: true,
L107: stdio: 'ignore',
High
vendor/@anvil/sdk/dist/index.cjsView file
28841contains invisible/control Unicode U+202C (pop directional formatting)
`, [232, 177], "ੰ", " साथ", " Block", " مط", " Live", " น", "<U+202C>", " Blog", " chi", "할", " experts", "well", "fd", " Material", [32, 229, 185], "While", "uar", ">&", "Inv", "inq", "Package", " capac", " covered", " zal", "fach", "Featu
Findings
1 Critical11 High6 Medium8 Low
CriticalTrojan Source Unicodevendor/@anvil/sdk/dist/index.cjs
HighChild Processvendor/@anvil/common/src/types/spawn.ts
HighShellsrc/utils/open-file.ts
HighObfuscated Payload Loadervendor/@anvil/sdk/dist/index.cjs
HighRemote Agent Bridgevendor/@anvil/sdk/dist/index.cjs
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Similaritysrc/utils/terminal-command-broker.ts
HighKnown Malware Source Similaritysrc/utils/clipboard.ts
HighKnown Malware Source Similaritysrc/utils/terminal-watchdog.ts
HighKnown Malware Source Similaritysrc/utils/detect-shell.ts
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @alumbwe/anvil@1.0.36.
The versions list below shows the verdict for each recorded version.
- Avoid installing @alumbwe/anvil@1.0.36. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.