Loading npm security reports…

@askexenow/exe-os@0.9.340: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.340

@askexenow/exe-os@0.9.340

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall unconditionally copies package skills into the global Claude directory. For an existing exe-os setup it also registers an MCP server, installs broad Claude lifecycle hooks, and grants its MCP tools permission.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation or update

Impact

Package code is invoked across Claude sessions and tool events, with broad package-defined MCP capabilities pre-authorized.

Mechanism

postinstall mutation of Claude Code global skills, hooks, MCP, and permissions

Policy narrative

Installing the package invokes a postinstall script. It copies Claude skills immediately and, when prior setup state exists, modifies Claude’s global MCP configuration and settings to execute package hook programs for numerous agent events while adding allow-list permissions for its tools. These unconsented install-time writes target a foreign, broad AI-agent control surface.

Rationale

Source inspection confirms the concrete install-time Claude Code control-surface mutation required for blocking. The scanner’s credential-exfiltration label is not independently confirmed, but is unnecessary to the verdict.

Evidence

package.jsondist/bin/install.jsdist/chunk-X425OEYF.jsdist/chunk-F55JF43M.js~/.claude/skills~/.claude.json~/.claude/settings.json~/.exe/mcp.json

Decision evidence

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/bin/install.jsView file

92Install-time AI-agent control hijack evidence: L162: // src/bin/install.ts L163: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L164: import { spawn, execSync } from "child_process"; ... L383: if (!existsSync(plistDir)) { L384: mkdirSync(plistDir, { recursive: true }); L385: } ... L402: } L403: writeFileSync(newPlistPath, finalPlistContent); L404: if (!reload) { ... L422: const binDir = path.join(home, ".exe-os", "bin"); L423: mkdirSync(binDir, { recursive: true }); L424: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L92: import { existsSync, readFileSync, mkdirSync, readdirSync } from "fs"; L93: import { spawn as spawnAsync } fro

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/bin/install.jsView on unpkg · L92

869process.stderr.write( L870: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n" L871: );

High

Shell

Package source references shell execution.

dist/bin/install.jsView on unpkg · L869

dist/chunk-7WPOJDTA.jsView file

173if (!process.env.DATABASE_URL) process.env.DATABASE_URL = url; L174: const { createRequire } = await import("module"); L175: const { pathToFileURL } = await import("url");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-7WPOJDTA.jsView on unpkg · L173

dist/chunk-KADUJ7PE.jsView file

12import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L121: try { L122: cfg = JSON.parse(readFileSync(configPath, "utf8")); L123: } catch { ... L126: const sentinelPath = path.join(exeDir, "embeddings-enabled"); L127: if (process.env.EXE_EMBEDDINGS !== void 0 || existsSync(sentinelPath) || cfg) { L128: return resolveEmbeddingsEnabled(process.env.EXE_EMBEDDINGS, cfg, sentinelPath); ... L137: function main() { L138: const HOME = os.homedir(); L139: const PLIST_NAME = "com.askexe.exed.plist";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-KADUJ7PE.jsView on unpkg · L12

dist/bin/exe-watchdog.jsView file

12import { randomUUID } from "crypto"; L13: import { spawn } from "child_process"; L14: import { get } from "http"; L15: import { join } from "path"; ... L17: import { homedir, userInfo, loadavg, cpus, platform } from "os"; L18: var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? join(homedir(), ".exe-os"); L19: var PID_PATH = join(EXE_DIR, "exed.pid");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/exe-watchdog.jsView on unpkg · L12

dist/chunk-F55JF43M.jsView file

22import crypto from "crypto"; L23: import { execSync } from "child_process"; L24: import { existsSync as existsSync2, mkdirSync, readFileSync, unlinkSync as unlinkSync2, writeFileSync, chmodSync } from "fs"; ... L33: import path from "path"; L34: var GGUF_URL = process.env.EXE_EMBED_MODEL_URL ?? ""; L35: var EXPECTED_SHA256 = process.env.EXE_EMBED_MODEL_SHA256 ?? ""; ... L104: resetInactivityTimer(); L105: if (!fileStream.write(value)) { L106: await new Promise((resolve) => fileStream.once("drain", resolve)); ... L135: if (attempt < MAX_RETRIES) { L136: process.stderr.write(` L137: Download attempt ${attempt} failed, retrying...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-F55JF43M.jsView on unpkg · L22

22Trigger-reachable chain: manifest.bin -> dist/bin/cli.js -> dist/setup-wizard-TOFEJPLF.js -> dist/chunk-F55JF43M.js L22: import crypto from "crypto"; L23: import { execSync } from "child_process"; L24: import { existsSync as existsSync2, mkdirSync, readFileSync, unlinkSync as unlinkSync2, writeFileSync, chmodSync } from "fs"; ... L33: import path from "path"; L34: var GGUF_URL = process.env.EXE_EMBED_MODEL_URL ?? ""; L35: var EXPECTED_SHA256 = process.env.EXE_EMBED_MODEL_SHA256 ?? ""; ... L104: resetInactivityTimer(); L105: if (!fileStream.write(value)) { L106: await new Promise((resolve) => fileStream.once("drain", resolve)); ... L135: if (attempt < MAX_RETRIES) { L136: process.stderr.write(` L137: Download attempt ${attempt} failed, retrying...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-F55JF43M.jsView on unpkg · L22

dist/chunk-7TS64TBG.jsView file

15// src/lib/exe-daemon-client.ts L16: import net from "net"; L17: import os from "os"; L18: import { spawn, execSync } from "child_process"; L19: import { randomUUID } from "crypto"; ... L26: function debugLog(msg) { L27: if (isDebug()) process.stderr.write(msg.endsWith("\n") ? msg : msg + "\n"); L28: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunk-7TS64TBG.jsView on unpkg · L15

dist/bin/cli.jsView file

7async function configureProxyFromEnv() { L8: if (!process.env.HTTP_PROXY && !process.env.HTTPS_PROXY && !process.env.NO_PROXY) return; L9: try { L10: const { setGlobalDispatcher, EnvHttpProxyAgent } = await import("undici"); L11: setGlobalDispatcher(new EnvHttpProxyAgent()); L12: } catch { L13: process.stderr.write("exe-os: HTTP(S)_PROXY is set, but undici proxy support is unavailable; continuing without global proxy.\n"); L14: } ... L26: var args = process.argv.slice(2); L27: if (process.platform === "win32") { L28: process.stderr.write( L29: "\nexe-os does not support native Windows. Use WSL2 instead:\n 1. Run `wsl --install` in PowerShell\n 2. Open Ubuntu/WSL2\n 3. Install and run exe-os inside WSL2\n\n"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/cli.jsView on unpkg · L7

dist/bin/deferred-daemon-restart.jsView file

137Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L137: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L138: import { spawn, execSync } from "child_process"; L139: import path from "path"; L140: import os from "os"; L141: var EXE_DIR = path.join(os.homedir(), ".exe-os"); L142: var DAEMON_PORT = 48739; ... L146: try { L147: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L148: return pkg.version; ... L167: versionMismatchWarned = true; L168: process.stderr.write( L169: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L137

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/deferred-daemon-restart.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

dist/bin/update.jsView file

149try { L150: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L151: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L149

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/bin/exe-boot.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-boot.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-boot.jsView on unpkg

dist/bin/exe-launch-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-launch-agent.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-launch-agent.jsView on unpkg

dist/bin/exe-start-codex.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-start-codex.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-start-codex.jsView on unpkg