@askexenow/exe-os@0.9.339: Suspicious npm security report (Warn)

Loading npm security reports…

@askexenow/exe-os@0.9.339: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged

package.jsonView file

Lines 96-136json

96 "@opentelemetry/exporter-logs-otlp-http": ">=0.219.0",

97 "@opentelemetry/exporter-logs-otlp-proto": ">=0.219.0",

98 "@opentelemetry/exporter-metrics-otlp-grpc": ">=0.219.0",

99 "@opentelemetry/exporter-metrics-otlp-http": ">=0.219.0",

100 "@opentelemetry/exporter-metrics-otlp-proto": ">=0.219.0",

101 "@opentelemetry/exporter-prometheus": ">=0.219.0",

102 "@opentelemetry/exporter-trace-otlp-grpc": ">=0.219.0",

103 "@opentelemetry/exporter-trace-otlp-http": ">=0.219.0",

104 "@opentelemetry/exporter-trace-otlp-proto": ">=0.219.0"

105 },

106 "engines": {

107 "node": ">=20.0.0"

108 },

109 "scripts": {

110 "test": "vitest run",

111 "test:watch": "vitest",

112 "lint": "eslint src/ --max-warnings 53",

113 "typecheck": "tsc --noEmit",

114 "build": "bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true)",

115 "deploy": "node dist/bin/pre-build-guard.js && npm run build && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",

116 "postinstall": "node dist/bin/install.js --commands-only || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L116

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L116

117 "prepublishOnly": "npm run typecheck && npm run build && node dist/bin/prune-orphan-chunks.js --force && npm run guard:esm-require && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",

118 "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/lib/stack-update.test.ts' - ...

119 "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",

120 "guard:esm-require": "node scripts/check-no-runtime-require.mjs",

121 "check:schema-version": "node scripts/check-schema-version.mjs",

122 "test:stack-sim": "node scripts/stack-sim.mjs",

123 "test:daemon-smoke": "vitest run --maxWorkers=1 tests/smoke/daemon-smoke-gate.test.ts"

124 },

125 "dependencies": {

126 "@anthropic-ai/sdk": "^0.95.2",

127 "@aws-sdk/client-s3": "^3.1052.0",

128 "@aws-sdk/s3-request-presigner": "^3.1052.0",

129 "@libsql/client": "^0.14.0",

130 "@modelcontextprotocol/sdk": "^1.29.0",

131 "@opentelemetry/api": "^1.9.1",

132 "@opentelemetry/sdk-node": "^0.219.0",

133 "@opentelemetry/sdk-trace-base": "^2.8.0",

134 "@slack/bolt": "^4.7.0",

135 "@slack/web-api": "^7.15.1",

136 "bip39": "^3.1.0",

Long lines were clipped for display.

dist/chunk-75H4R62K.jsView file

Lines 1-21javascript

1// src/lib/cc-binary-detect.ts

2import { execSync } from "child_process";

3import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

4import path from "path"

dist/bin/install.jsView file

Lines 849-889javascript

849 }

850 if (process.platform === "darwin") {

851 try {

852 setupDailySummaryCron();

853 } catch (err) {

854 process.stderr.write(`exe-os: daily summary cron setup failed: ${

dist/chunk-RDTZTLVQ.jsView file

Lines 153-193javascript

153 try {

154 if (existsSync(configPath)) {

155 const cfg = JSON.parse(readFileSync(configPath, "utf8"));

156 cloudPostgresUrl

dist/chunk-KADUJ7PE.jsView file

Lines 1-32javascript

1import {

2 resolveEmbeddingsEnabled

3} from "./chunk-KWOAM7TA.js";

4import {

5 computeDaemonHeapCapMb

6} from "./chunk-NLEW62VC.js";

7import {

dist/bin/exe-watchdog.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 checkCpuStealSync

4} from "../chunk-SSC7EKY2.js";

5import {

6 isMainModule

7} from "../chunk-6Y4B3QF6.js";

8import

dist/chunk-BVV6NHKQ.jsView file

Lines 29-69javascript

29}

30function sendDesktopNotification(title, body, sessionScope) {

31 try {

32 const safeTitle = title.replace(/

dist/bin/cli.jsView file

7async function configureProxyFromEnv() { L8: if (!process.env.HTTP_PROXY && !process.env.HTTPS_PROXY && !process.env.NO_PROXY) return; L9: try { L10: const { setGlobalDispatcher, EnvHttpProxyAgent } = await import("undici"); L11: setGlobalDispatcher(new EnvHttpProxyAgent()); L12: } catch { L13: process.stderr.write("exe-os: HTTP(S)_PROXY is set, but undici proxy support is unavailable; continuing without global proxy.\n"); L14: } ... L26: var args = process.argv.slice(2); L27: if (process.platform === "win32") { L28: process.stderr.write( L29: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

137Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L137: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L138: import { spawn, execSync } from "child_process"; L139: import path from "path"; L140: import os from "os"; L141: var EXE_DIR = path.join(os.homedir(), ".exe-os"); L142: var DAEMON_PORT = 48739; ... L146: try { L147: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L148: return pkg.version; ... L167: versionMismatchWarned = true; L168: process.stderr.write( L169: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L137

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/deferred-daemon-restart.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/bin/exe-boot.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-boot.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-boot.jsView on unpkg

dist/bin/exe-launch-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-launch-agent.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-launch-agent.jsView on unpkg

dist/bin/exe-start-codex.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-start-codex.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-start-codex.jsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/bin/install.jsView file

92Install-time AI-agent control hijack evidence: L162: // src/bin/install.ts L163: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L164: import { spawn, execSync } from "child_process"; ... L383: if (!existsSync(plistDir)) { L384: mkdirSync(plistDir, { recursive: true }); L385: } ... L402: } L403: writeFileSync(newPlistPath, finalPlistContent); L404: if (!reload) { ... L422: const binDir = path.join(home, ".exe-os", "bin"); L423: mkdirSync(binDir, { recursive: true }); L424: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L92: import { existsSync, readFileSync, mkdirSync, readdirSync } from "fs"; L93: import { spawn as spawnAsync } fro

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/bin/install.jsView on unpkg · L92

869process.stderr.write( L870: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n" L871: );

High

Shell

Package source references shell execution.

dist/bin/install.jsView on unpkg · L869

dist/chunk-RDTZTLVQ.jsView file

173if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url; L174: const { createRequire } = await import("module"); L175: const { pathToFileURL } = await import("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-RDTZTLVQ.jsView on unpkg · L173

dist/chunk-KADUJ7PE.jsView file

12import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L121: try { L122: cfg = JSON.parse(readFileSync(configPath, "utf8")); L123: } catch { ... L126: const sentinelPath = path.join(exeDir, "embeddings-enabled"); L127: if (process.env.EXE_EMBEDDINGS !== void 0 || existsSync(sentinelPath) || cfg) { L128: return resolveEmbeddingsEnabled(process.env.EXE_EMBEDDINGS, cfg, sentinelPath); ... L137: function main() { L138: const HOME = os.homedir(); L139: const PLIST_NAME = "com.askexe.exed.plist";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-KADUJ7PE.jsView on unpkg · L12

dist/bin/exe-watchdog.jsView file

12import { randomUUID } from "crypto"; L13: import { spawn } from "child_process"; L14: import { get } from "http"; L15: import { join } from "path"; ... L17: import { homedir, userInfo, loadavg, cpus, platform } from "os"; L18: var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? join(homedir(), ".exe-os"); L19: var PID_PATH = join(EXE_DIR, "exed.pid");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/exe-watchdog.jsView on unpkg · L12

dist/chunk-BVV6NHKQ.jsView file

49if (process.platform === "linux") { L50: execSync(`notify-send "${safeTitle}" "${safeBody}"`, { L51: timeout: DESKTOP_TIMEOUT_MS, ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-BVV6NHKQ.jsView on unpkg · L49

dist/bin/cli.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L137

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/bin/exe-boot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-boot.jsView on unpkg

dist/bin/exe-launch-agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-launch-agent.jsView on unpkg

dist/bin/exe-start-codex.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-start-codex.jsView on unpkg

Source & flagged code

18 flagged

package.jsonView file

Lines 96-136json

96 "@opentelemetry/exporter-logs-otlp-http": ">=0.219.0",

97 "@opentelemetry/exporter-logs-otlp-proto": ">=0.219.0",

98 "@opentelemetry/exporter-metrics-otlp-grpc": ">=0.219.0",

99 "@opentelemetry/exporter-metrics-otlp-http": ">=0.219.0",

100 "@opentelemetry/exporter-metrics-otlp-proto": ">=0.219.0",

101 "@opentelemetry/exporter-prometheus": ">=0.219.0",

102 "@opentelemetry/exporter-trace-otlp-grpc": ">=0.219.0",

103 "@opentelemetry/exporter-trace-otlp-http": ">=0.219.0",

104 "@opentelemetry/exporter-trace-otlp-proto": ">=0.219.0"

105 },

106 "engines": {

107 "node": ">=20.0.0"

108 },

109 "scripts": {

110 "test": "vitest run",

111 "test:watch": "vitest",

112 "lint": "eslint src/ --max-warnings 53",

113 "typecheck": "tsc --noEmit",

116 "postinstall": "node dist/bin/install.js --commands-only || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L116

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L116

119 "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",

120 "guard:esm-require": "node scripts/check-no-runtime-require.mjs",

121 "check:schema-version": "node scripts/check-schema-version.mjs",

122 "test:stack-sim": "node scripts/stack-sim.mjs",

123 "test:daemon-smoke": "vitest run --maxWorkers=1 tests/smoke/daemon-smoke-gate.test.ts"

124 },

125 "dependencies": {

126 "@anthropic-ai/sdk": "^0.95.2",

127 "@aws-sdk/client-s3": "^3.1052.0",

128 "@aws-sdk/s3-request-presigner": "^3.1052.0",

129 "@libsql/client": "^0.14.0",

130 "@modelcontextprotocol/sdk": "^1.29.0",

131 "@opentelemetry/api": "^1.9.1",

132 "@opentelemetry/sdk-node": "^0.219.0",

133 "@opentelemetry/sdk-trace-base": "^2.8.0",

134 "@slack/bolt": "^4.7.0",

135 "@slack/web-api": "^7.15.1",

136 "bip39": "^3.1.0",

Long lines were clipped for display.

dist/chunk-75H4R62K.jsView file

Lines 1-21javascript

1// src/lib/cc-binary-detect.ts

2import { execSync } from "child_process";

3import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

4import path from "path"

dist/bin/install.jsView file

Lines 849-889javascript

849 }

850 if (process.platform === "darwin") {

851 try {

852 setupDailySummaryCron();

853 } catch (err) {

854 process.stderr.write(`exe-os: daily summary cron setup failed: ${

dist/chunk-RDTZTLVQ.jsView file

Lines 153-193javascript

153 try {

154 if (existsSync(configPath)) {

155 const cfg = JSON.parse(readFileSync(configPath, "utf8"));

156 cloudPostgresUrl

dist/chunk-KADUJ7PE.jsView file

Lines 1-32javascript

1import {

2 resolveEmbeddingsEnabled

3} from "./chunk-KWOAM7TA.js";

4import {

5 computeDaemonHeapCapMb

6} from "./chunk-NLEW62VC.js";

7import {

dist/bin/exe-watchdog.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 checkCpuStealSync

4} from "../chunk-SSC7EKY2.js";

5import {

6 isMainModule

7} from "../chunk-6Y4B3QF6.js";

8import

dist/chunk-BVV6NHKQ.jsView file

Lines 29-69javascript

29}

30function sendDesktopNotification(title, body, sessionScope) {

31 try {

32 const safeTitle = title.replace(/

dist/bin/cli.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L137

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/bin/exe-boot.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-boot.jsView on unpkg

dist/bin/exe-launch-agent.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-launch-agent.jsView on unpkg

dist/bin/exe-start-codex.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-start-codex.jsView on unpkg

@askexenow/exe-os@0.9.339

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code