Loading npm security reports…

@askexenow/exe-os@0.9.331: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.331

@askexenow/exe-os@0.9.331

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the user-wide Claude Code control surface. On an existing exe-os setup it installs a package MCP server, broad event hooks, and MCP permissions; it also unconditionally drops skills.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install/update executes postinstall

Impact

Package code executes across future Claude Code prompts, tool calls, sessions, and agent events.

Mechanism

postinstall writes Claude skills, MCP configuration, hooks, permissions, and instructions

Policy narrative

Installing the package automatically executes its installer. It writes package-controlled skills into Claude Code’s global skills directory; if prior exe-os state exists, it registers an MCP server, injects commands for numerous Claude hook events, and adds allowlisted MCP capabilities. Its installer also inserts rules into the global Claude instructions stating they override default behavior. This is an unconsented install-time mutation of a broad foreign AI-agent control surface.

Rationale

The lifecycle path establishes persistent, user-wide Claude Code execution and instruction control without an explicit setup command. This meets the blocking policy regardless of otherwise user-configured runtime networking.

Evidence

package.jsondist/bin/install.jsdist/chunk-QVM5KATG.jsdist/hooks/post-tool-combined.jsdist/hooks/prompt-submit.js~/.claude/skills/exe-*/SKILL.md~/.claude.json~/.claude/settings.json

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/bin/install.jsView file

92Install-time AI-agent control hijack evidence: L160: // src/bin/install.ts L161: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L162: import { spawn, execSync } from "child_process"; ... L381: if (!existsSync(plistDir)) { L382: mkdirSync(plistDir, { recursive: true }); L383: } ... L400: } L401: writeFileSync(newPlistPath, finalPlistContent); L402: if (!reload) { ... L420: const binDir = path.join(home, ".exe-os", "bin"); L421: mkdirSync(binDir, { recursive: true }); L422: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L92: import { existsSync, readFileSync, mkdirSync, readdirSync } from "fs"; L93: import { spawn as spawnAsync } fro

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/bin/install.jsView on unpkg · L92

867process.stderr.write( L868: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n" L869: );

High

Shell

Package source references shell execution.

dist/bin/install.jsView on unpkg · L867

dist/chunk-LKB2VIIV.jsView file

167if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url; L168: const { createRequire } = await import("module"); L169: const { pathToFileURL } = await import("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-LKB2VIIV.jsView on unpkg · L167

dist/chunk-KADUJ7PE.jsView file

12import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L121: try { L122: cfg = JSON.parse(readFileSync(configPath, "utf8")); L123: } catch { ... L126: const sentinelPath = path.join(exeDir, "embeddings-enabled"); L127: if (process.env.EXE_EMBEDDINGS !== void 0 || existsSync(sentinelPath) || cfg) { L128: return resolveEmbeddingsEnabled(process.env.EXE_EMBEDDINGS, cfg, sentinelPath); ... L137: function main() { L138: const HOME = os.homedir(); L139: const PLIST_NAME = "com.askexe.exed.plist";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-KADUJ7PE.jsView on unpkg · L12

dist/bin/exe-watchdog.jsView file

12import { randomUUID } from "crypto"; L13: import { spawn } from "child_process"; L14: import { get } from "http"; L15: import { join } from "path"; ... L17: import { homedir, userInfo, loadavg, cpus, platform } from "os"; L18: var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? join(homedir(), ".exe-os"); L19: var PID_PATH = join(EXE_DIR, "exed.pid");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/exe-watchdog.jsView on unpkg · L12

dist/chunk-BVV6NHKQ.jsView file

49if (process.platform === "linux") { L50: execSync(`notify-send "${safeTitle}" "${safeBody}"`, { L51: timeout: DESKTOP_TIMEOUT_MS, ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-BVV6NHKQ.jsView on unpkg · L49

49Trigger-reachable chain: scripts.postinstall -> dist/bin/install.js -> dist/chunk-5JILQMRS.js -> dist/push-notifications-W5JRXLKJ.js -> dist/chunk-BVV6NHKQ.js L49: if (process.platform === "linux") { L50: execSync(`notify-send "${safeTitle}" "${safeBody}"`, { L51: timeout: DESKTOP_TIMEOUT_MS, ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-BVV6NHKQ.jsView on unpkg · L49

dist/bin/cli.jsView file

7async function configureProxyFromEnv() { L8: if (!process.env.HTTP_PROXY && !process.env.HTTPS_PROXY && !process.env.NO_PROXY) return; L9: try { L10: const { setGlobalDispatcher, EnvHttpProxyAgent } = await import("undici"); L11: setGlobalDispatcher(new EnvHttpProxyAgent()); L12: } catch { L13: process.stderr.write("exe-os: HTTP(S)_PROXY is set, but undici proxy support is unavailable; continuing without global proxy.\n"); L14: } ... L26: var args = process.argv.slice(2); L27: if (process.platform === "win32") { L28: process.stderr.write( L29: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @askexenow/exe-os@0.9.319 matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.319 similarity = 0.508 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

135Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L135: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L136: import { spawn, execSync } from "child_process"; L137: import path from "path"; L138: import os from "os"; L139: var EXE_DIR = path.join(os.homedir(), ".exe-os"); L140: var DAEMON_PORT = 48739; ... L144: try { L145: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L146: return pkg.version; ... L165: versionMismatchWarned = true; L166: process.stderr.write( L167: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L135

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 95-135json

95 "@opentelemetry/exporter-logs-otlp-http": ">=0.219.0",

96 "@opentelemetry/exporter-logs-otlp-proto": ">=0.219.0",

97 "@opentelemetry/exporter-metrics-otlp-grpc": ">=0.219.0",

98 "@opentelemetry/exporter-metrics-otlp-http": ">=0.219.0",

99 "@opentelemetry/exporter-metrics-otlp-proto": ">=0.219.0",

100 "@opentelemetry/exporter-prometheus": ">=0.219.0",

101 "@opentelemetry/exporter-trace-otlp-grpc": ">=0.219.0",

102 "@opentelemetry/exporter-trace-otlp-http": ">=0.219.0",

103 "@opentelemetry/exporter-trace-otlp-proto": ">=0.219.0"

104 },

105 "engines": {

106 "node": ">=20.0.0"

107 },

108 "scripts": {

109 "test": "vitest run",

110 "test:watch": "vitest",

111 "lint": "eslint src/ --max-warnings 53",

112 "typecheck": "tsc --noEmit",

113 "build": "bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true)",

114 "deploy": "node dist/bin/pre-build-guard.js && npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",

115 "postinstall": "node dist/bin/install.js --commands-only || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L115

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L115

116 "prepublishOnly": "npm run typecheck && npm run build && node dist/bin/prune-orphan-chunks.js --force && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",

117 "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/device-id-split-brain.test. ...

118 "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",

119 "guard:esm-require": "node scripts/check-no-runtime-require.mjs",

120 "check:schema-version": "node scripts/check-schema-version.mjs",

121 "test:stack-sim": "node scripts/stack-sim.mjs",

122 "test:daemon-smoke": "vitest run --maxWorkers=1 tests/smoke/daemon-smoke-gate.test.ts"

123 },

124 "dependencies": {

125 "@anthropic-ai/sdk": "^0.95.2",

126 "@aws-sdk/client-s3": "^3.1052.0",

127 "@aws-sdk/s3-request-presigner": "^3.1052.0",

128 "@libsql/client": "^0.14.0",

129 "@modelcontextprotocol/sdk": "^1.29.0",

130 "@opentelemetry/api": "^1.9.1",

131 "@opentelemetry/sdk-node": "^0.219.0",

132 "@opentelemetry/sdk-trace-base": "^2.8.0",

133 "@slack/bolt": "^4.7.0",

134 "@slack/web-api": "^7.15.1",

135 "bip39": "^3.1.0",

Long lines were clipped for display.

dist/chunk-75H4R62K.jsView file

Lines 1-21javascript

1// src/lib/cc-binary-detect.ts

2import { execSync } from "child_process";

3import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

4import path from "path"

dist/bin/install.jsView file

Lines 847-887javascript

847 }

848 if (process.platform === "darwin") {

849 try {

850 setupDailySummaryCron();

851 } catch (err) {

852 process.stderr.write(`exe-os: daily summary cron setup failed: ${

dist/chunk-LKB2VIIV.jsView file

Lines 147-187javascript

147 try {

148 if (existsSync(configPath)) {

149 const cfg = JSON.parse(readFileSync(configPath, "utf8"));

150 cloudPostgresUrl

dist/chunk-KADUJ7PE.jsView file

Lines 1-32javascript

1import {

2 resolveEmbeddingsEnabled

3} from "./chunk-KWOAM7TA.js";

4import {

5 computeDaemonHeapCapMb

6} from "./chunk-NLEW62VC.js";

7import {

8

dist/bin/exe-watchdog.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 checkCpuStealSync

4} from "../chunk-SSC7EKY2.js";

5import {

6 isMainModule

7} from "../chunk-6Y4B3QF6.js";

8import

dist/chunk-BVV6NHKQ.jsView file

Lines 29-69javascript

29}

30function sendDesktopNotification(title, body, sessionScope) {

31 try {

32 const safeTitle = title.replace(/

dist/bin/cli.jsView file

7async function configureProxyFromEnv() { L8: if (!process.env.HTTP_PROXY && !process.env.HTTPS_PROXY && !process.env.NO_PROXY) return; L9: try { L10: const { setGlobalDispatcher, EnvHttpProxyAgent } = await import("undici"); L11: setGlobalDispatcher(new EnvHttpProxyAgent()); L12: } catch { L13: process.stderr.write("exe-os: HTTP(S)_PROXY is set, but undici proxy support is unavailable; continuing without global proxy.\n"); L14: } ... L26: var args = process.argv.slice(2); L27: if (process.platform === "win32") { L28: process.stderr.write( L29: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @askexenow/exe-os@0.9.319 matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.319 similarity = 0.508 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

135Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L135: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L136: import { spawn, execSync } from "child_process"; L137: import path from "path"; L138: import os from "os"; L139: var EXE_DIR = path.join(os.homedir(), ".exe-os"); L140: var DAEMON_PORT = 48739; ... L144: try { L145: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L146: return pkg.version; ... L165: versionMismatchWarned = true; L166: process.stderr.write( L167: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L135

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg