@alumbwe/anvil@1.0.42

A Terminal User Interface (TUI) package built with OpenTUI and React.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has substantial agent command-execution, global-installation, and telemetry capability, but it lacks an install-time trigger or a concrete malicious chain. Its risk is real enough to warn rather than mark clean.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs anvil, or an Anvil agent invokes its terminal-command path.

Impact

A user-invoked session can execute requested commands and transmit authenticated session or log data; the global Bun installation changes the machine's npm environment.

Mechanism

Automatic global runtime installation, command execution broker, and service telemetry.

AI rationale

Evidence

bin/anvil.jssrc/utils/terminal-command-broker.tssrc/utils/anvil-session-api.tssrc/utils/log-shipper.tssrc/agents/bundled-agents.generated.ts

Network endpoints1

anvil.dev

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The command broker launches an executable, arguments, working directory, and environment supplied by a request.
Running the CLI automatically installs Bun globally when it is absent.
Authenticated session calls send a bearer token to the Anvil service.
Production logging ships buffered records to an API endpoint by default.
Bundled configuration provides an AI-agent orchestration surface.

Evidence against

The manifest has no npm install, preinstall, or postinstall hook; its only lifecycle hook is prepublishOnly.
The global installation is triggered only after a user runs the anvil command.
The inspected network calls are named Anvil product endpoints or telemetry paths, not an opaque payload host.
No source inspected showed credential harvesting, hidden persistence, self-dependency, or install-time project mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

16 flagged

bin/anvil.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * Anvil CLI launcher — the npm `bin` entry for `anvil`.

4 *

5 * Runs on plain Node.js (Bun is NOT required upfront) and works from cmd,

6 * PowerShell and POSIX shells: npm generates a shim for each shell that all

7 * execute this file with `node`.

High

Shell

Package source references shell execution.

bin/anvil.jsView on unpkg · L5

8 *

9 * Strategy:

10 * 1. Already running under Bun (e.g. `bunx anvil`) → import the TS entry directly.

11 * 2. Else locate a Bun executable: local node_modules/.bin, global

12 * node_modules/.bin, ~/.bun/bin, /usr/local/bin, Homebrew, then PATH.

13 * 3. Else install Bun once via `npm i -g bun`, then retry.

14 * 4. Spawn `bun src/entry.ts <args>` with inherited stdio and forward the

15 * exit code, so the TUI behaves exactly as when run directly.

16 */

18import { spawnSync } from 'child_process'

19import fs from 'fs'

High

Child Process

Package source references child process execution.

bin/anvil.jsView on unpkg · L17

20import os from 'os'

21import path from 'path'

22import { fileURLToPath, pathToFileURL } from 'url'

24const HERE = path.dirname(fileURLToPath(import.meta.url))

25const PKG_ROOT = path.resolve(HERE, '..')

26const ENTRY = path.join(PKG_ROOT, 'src', 'entry.ts')

27const IS_WIN = process.platform === 'win32'

28const BUN_EXE = IS_WIN ? 'bun.exe' : 'bun'

30/** Check that a candidate command is a working bun executable. */

31function isBun(cmd) {

32 try {

33 const r = spawnSync(cmd, ['--version'], {

34 encoding: 'utf8',

35 timeout: 15000,

36 windowsHide: true,

37 })

Lines 79-119javascript

79 stdio: 'inherit',

80 shell: IS_WIN,

81 windowsHide: true,

82 })

83 return r.status === 0

84}

vendor/@anvil/sdk/dist/index.cjsView file

28841contains invisible/control Unicode U+202C (pop directional formatting) `, [232, 177], "ੰ", " साथ", " Block", " مط", " Live", " น", "<U+202C>", " Blog", " chi", "할", " experts", "well", "fd", " Material", [32, 229, 185], "While", "uar", ">&", "Inv", "inq", "Package", " capac", " covered", " zal", "fach", "Featu

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L28841

66function setTreeSitterWasmPath(wasmPath) { L67: process.env[TREE_SITTER_WASM_ENV_VAR] = wasmPath; L68: } ... L72: function downloadWasmTo(targetPath) { L73: process.stderr.write(`[tree-sitter] tree-sitter.wasm missing; downloading to ${targetPath} L74: `); ... L76: try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L149: WASM_DOWNLOAD_URLS = [ L150: `https://unpkg.com/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`, L151: `https://cdn.jsdelivr.net/npm/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L66

76try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L202: try { L203: fs2.writeFileSync("../debug/debug-parse.json", JSON.stringify({ L204: tokenCallers, ... L22474: var SUMMARY_HEADER = "This is a summary of the conversation so far. The original messages have been condensed to save context space."; L22475: var SUMMARY_DISCLAIMER = "Historical memory only. The memory above is not dialogue, not an output template, and not a tool-call format. Continue from the live user message below. W... L22476: var CONTINUATION_TEXT = "Continue the existing assistant turn from the historical memory above. The original user request and completed assistant/tool work are recorded there. Do n... ... L35019: const { endpoint, payload, fetch: fetch2, logger: logger2, env: env2, request

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView file

•path = vendor/@[redacted]-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

src/hooks/use-gravity-ad.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/hooks/use-gravity-ad.ts#virtual:normalized:round1View on unpkg

src/utils/terminal-command-broker.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/terminal-command-broker.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High