Loading npm security reports…

@askexenow/exe-os@0.9.335: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.335

@askexenow/exe-os@0.9.335

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall modifies the global Claude Code control surface after prior package setup. It registers package code as an MCP server and installs hooks across prompt, tool, and session events.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install or update after ~/.exe-os/setup-state.json or ~/.exe-os/config.json exists

Impact

Package code executes in future Claude Code sessions and observes broad agent lifecycle/tool activity.

Mechanism

postinstall writes global MCP configuration and broad Claude hooks

Policy narrative

The package's npm postinstall invokes an installer that, on machines previously set up for exe-os, adds its MCP server to ~/.claude.json and broad command hooks to ~/.claude/settings.json. Those hooks execute package code on prompts, tool calls, session events, and stop events; the post-tool matcher includes Bash, file operations, Agent, and all MCP tools. This is unconsented install-time mutation of a foreign, broad AI-agent control surface.

Rationale

Source inspection confirms the lifecycle script persistently wires package-controlled code into Claude Code's global configuration and hooks. This meets the firewall block policy for postinstall mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsondist/bin/install.jsdist/chunk-QVM5KATG.jsdist/hooks/post-tool-combined.jsdist/hooks/prompt-submit.jsdist/hooks/stop.js~/.claude.json~/.claude/settings.json

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/bin/install.jsView file

92Install-time AI-agent control hijack evidence: L160: // src/bin/install.ts L161: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L162: import { spawn, execSync } from "child_process"; ... L381: if (!existsSync(plistDir)) { L382: mkdirSync(plistDir, { recursive: true }); L383: } ... L400: } L401: writeFileSync(newPlistPath, finalPlistContent); L402: if (!reload) { ... L420: const binDir = path.join(home, ".exe-os", "bin"); L421: mkdirSync(binDir, { recursive: true }); L422: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L92: import { existsSync, readFileSync, mkdirSync, readdirSync } from "fs"; L93: import { spawn as spawnAsync } fro

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/bin/install.jsView on unpkg · L92

867process.stderr.write( L868: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n" L869: );

High

Shell

Package source references shell execution.

dist/bin/install.jsView on unpkg · L867

dist/chunk-QYTUXYAM.jsView file

853Cross-file remote execution chain: dist/chunk-QYTUXYAM.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L853: agent_role: agentRole, L854: session_id: process.env.SESSION_ID ?? "manual", L855: timestamp: (/* @__PURE__ */ new Date()).toISOString(), ... L963: } catch (err) { L964: process.stderr.write( L965: `[commit-memory] Failed to archive superseded memory ${supersedes_id}: ${err instanceof Error ? err.message : String(err)} ... L2330: try { L2331: const cp = JSON.parse(String(row.checkpoint)); L2332: lines.push( ... L2436: const preflightWarnings = []; L2437: const baseDir = process.cwd(); L2438: if (assignee) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-QYTUXYAM.jsView on unpkg · L853

517if (!isInitialized()) { L518: const { fastDbInit: fastDbInit2 } = await import("./fast-db-init-KIS7XQO5.js"); L519: await fastDbInit2();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QYTUXYAM.jsView on unpkg · L517

dist/chunk-KADUJ7PE.jsView file

12import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L121: try { L122: cfg = JSON.parse(readFileSync(configPath, "utf8")); L123: } catch { ... L126: const sentinelPath = path.join(exeDir, "embeddings-enabled"); L127: if (process.env.EXE_EMBEDDINGS !== void 0 || existsSync(sentinelPath) || cfg) { L128: return resolveEmbeddingsEnabled(process.env.EXE_EMBEDDINGS, cfg, sentinelPath); ... L137: function main() { L138: const HOME = os.homedir(); L139: const PLIST_NAME = "com.askexe.exed.plist";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-KADUJ7PE.jsView on unpkg · L12

dist/bin/exe-watchdog.jsView file

12import { randomUUID } from "crypto"; L13: import { spawn } from "child_process"; L14: import { get } from "http"; L15: import { join } from "path"; ... L17: import { homedir, userInfo, loadavg, cpus, platform } from "os"; L18: var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? join(homedir(), ".exe-os"); L19: var PID_PATH = join(EXE_DIR, "exed.pid");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/exe-watchdog.jsView on unpkg · L12

dist/chunk-BVV6NHKQ.jsView file

49if (process.platform === "linux") { L50: execSync(`notify-send "${safeTitle}" "${safeBody}"`, { L51: timeout: DESKTOP_TIMEOUT_MS, ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-BVV6NHKQ.jsView on unpkg · L49

dist/bin/cli.jsView file

7async function configureProxyFromEnv() { L8: if (!process.env.HTTP_PROXY && !process.env.HTTPS_PROXY && !process.env.NO_PROXY) return; L9: try { L10: const { setGlobalDispatcher, EnvHttpProxyAgent } = await import("undici"); L11: setGlobalDispatcher(new EnvHttpProxyAgent()); L12: } catch { L13: process.stderr.write("exe-os: HTTP(S)_PROXY is set, but undici proxy support is unavailable; continuing without global proxy.\n"); L14: } ... L26: var args = process.argv.slice(2); L27: if (process.platform === "win32") { L28: process.stderr.write( L29: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/deferred-daemon-restart.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @askexenow/exe-os@0.9.319 matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.319 similarity = 0.517 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg