Loading npm security reports…

@askexenow/exe-os@0.9.338: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.338

@askexenow/exe-os@0.9.338

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates Claude Code's global skills, MCP configuration, hooks, and permission allowlist. Installed hooks then observe agent prompts, tool activity, and transcripts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation or update when ~/.exe-os setup state exists

Impact

Executes package code across future Claude Code sessions and grants its MCP tools broad permissions.

Mechanism

automatic Claude Code control-surface registration and hook persistence

Policy narrative

The postinstall lifecycle invokes install.js. It always writes package-controlled skills into Claude Code's global skills directory; once any exe-os setup state exists, it silently registers the package MCP server, injects numerous session/tool/prompt hooks, and expands the Claude permission allowlist. Those hooks process prompts, tool input/output, and transcript data in later agent sessions.

Rationale

This is concrete, unconsented postinstall mutation of a foreign and broad AI-agent control surface, followed by persistent execution over future Claude Code events. That meets the blocking policy even without a confirmed remote exfiltration host.

Evidence

package.jsondist/bin/install.jsdist/chunk-X425OEYF.jsdist/hooks/post-tool-combined.jsdist/hooks/prompt-submit.jsdist/hooks/stop.js~/.claude/skills/exe-*/SKILL.md~/.claude.json~/.claude/settings.json

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/bin/install.jsView file

92Install-time AI-agent control hijack evidence: L162: // src/bin/install.ts L163: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L164: import { spawn, execSync } from "child_process"; ... L383: if (!existsSync(plistDir)) { L384: mkdirSync(plistDir, { recursive: true }); L385: } ... L402: } L403: writeFileSync(newPlistPath, finalPlistContent); L404: if (!reload) { ... L422: const binDir = path.join(home, ".exe-os", "bin"); L423: mkdirSync(binDir, { recursive: true }); L424: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L92: import { existsSync, readFileSync, mkdirSync, readdirSync } from "fs"; L93: import { spawn as spawnAsync } fro

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/bin/install.jsView on unpkg · L92

869process.stderr.write( L870: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n" L871: );

High

Shell

Package source references shell execution.

dist/bin/install.jsView on unpkg · L869

dist/chunk-RDTZTLVQ.jsView file

173if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url; L174: const { createRequire } = await import("module"); L175: const { pathToFileURL } = await import("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RDTZTLVQ.jsView on unpkg · L173

dist/chunk-KADUJ7PE.jsView file

12import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L121: try { L122: cfg = JSON.parse(readFileSync(configPath, "utf8")); L123: } catch { ... L126: const sentinelPath = path.join(exeDir, "embeddings-enabled"); L127: if (process.env.EXE_EMBEDDINGS !== void 0 || existsSync(sentinelPath) || cfg) { L128: return resolveEmbeddingsEnabled(process.env.EXE_EMBEDDINGS, cfg, sentinelPath); ... L137: function main() { L138: const HOME = os.homedir(); L139: const PLIST_NAME = "com.askexe.exed.plist";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-KADUJ7PE.jsView on unpkg · L12

dist/bin/exe-watchdog.jsView file

12import { randomUUID } from "crypto"; L13: import { spawn } from "child_process"; L14: import { get } from "http"; L15: import { join } from "path"; ... L17: import { homedir, userInfo, loadavg, cpus, platform } from "os"; L18: var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? join(homedir(), ".exe-os"); L19: var PID_PATH = join(EXE_DIR, "exed.pid");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/exe-watchdog.jsView on unpkg · L12

dist/chunk-BVV6NHKQ.jsView file

49if (process.platform === "linux") { L50: execSync(`notify-send "${safeTitle}" "${safeBody}"`, { L51: timeout: DESKTOP_TIMEOUT_MS, ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-BVV6NHKQ.jsView on unpkg · L49

dist/bin/cli.jsView file

7async function configureProxyFromEnv() { L8: if (!process.env.HTTP_PROXY && !process.env.HTTPS_PROXY && !process.env.NO_PROXY) return; L9: try { L10: const { setGlobalDispatcher, EnvHttpProxyAgent } = await import("undici"); L11: setGlobalDispatcher(new EnvHttpProxyAgent()); L12: } catch { L13: process.stderr.write("exe-os: HTTP(S)_PROXY is set, but undici proxy support is unavailable; continuing without global proxy.\n"); L14: } ... L26: var args = process.argv.slice(2); L27: if (process.platform === "win32") { L28: process.stderr.write( L29: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

137Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L137: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L138: import { spawn, execSync } from "child_process"; L139: import path from "path"; L140: import os from "os"; L141: var EXE_DIR = path.join(os.homedir(), ".exe-os"); L142: var DAEMON_PORT = 48739; ... L146: try { L147: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L148: return pkg.version; ... L167: versionMismatchWarned = true; L168: process.stderr.write( L169: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L137

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/deferred-daemon-restart.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/bin/exe-boot.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-boot.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-boot.jsView on unpkg

dist/bin/exe-launch-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-launch-agent.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-launch-agent.jsView on unpkg

dist/bin/exe-start-codex.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-start-codex.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-start-codex.jsView on unpkg