Loading npm security reports…

@askexenow/exe-os@0.9.344: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.344

@askexenow/exe-os@0.9.344

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates the broad Claude Code control surface. It installs package skills unconditionally and, for existing setup, registers MCP, hooks, and allowlisted tools.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install / package postinstall

Impact

Package code executes on Claude prompt and tool lifecycle events and can influence agent behavior.

Mechanism

Global Claude skills, MCP, hooks, and permission mutation

Policy narrative

Installing the package invokes postinstall. It copies package-controlled skills to the user-wide Claude directory even before setup; where prior setup exists, it also writes a global MCP entry, lifecycle hooks for prompt and tool events, and MCP permission allowlist entries. The installed post-tool hook receives tool inputs and outputs and records them through package services, creating a broad unconsented agent-control surface.

Rationale

Source inspection confirms an install-time, user-wide Claude Code control-surface mutation, not merely suspicious primitives. This meets the blocking policy regardless of the lack of a confirmed external exfiltration host in the inspected hook path.

Evidence

package.jsondist/bin/install.jsdist/chunk-FM5QLDG6.jsdist/hooks/post-tool-combined.jsdist/hooks/prompt-submit.js~/.claude/skills~/.claude.json~/.claude/settings.json

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/chunk-4XIHTE2R.jsView file

25import crypto from "crypto"; L26: import { execSync } from "child_process"; L27: import { existsSync as existsSync2, mkdirSync, readFileSync, unlinkSync as unlinkSync2, writeFileSync, chmodSync } from "fs"; ... L36: import path from "path"; L37: var GGUF_URL = process.env.EXE_EMBED_MODEL_URL ?? ""; L38: var EXPECTED_SHA256 = process.env.EXE_EMBED_MODEL_SHA256 ?? ""; ... L107: resetInactivityTimer(); L108: if (!fileStream.write(value)) { L109: await new Promise((resolve) => fileStream.once("drain", resolve)); ... L138: if (attempt < MAX_RETRIES) { L139: process.stderr.write(` L140: Download attempt ${attempt} failed, retrying...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-4XIHTE2R.jsView on unpkg · L25

25Trigger-reachable chain: manifest.bin -> dist/bin/cli.js -> dist/setup-wizard-PUA24CMQ.js -> dist/chunk-4XIHTE2R.js L25: import crypto from "crypto"; L26: import { execSync } from "child_process"; L27: import { existsSync as existsSync2, mkdirSync, readFileSync, unlinkSync as unlinkSync2, writeFileSync, chmodSync } from "fs"; ... L36: import path from "path"; L37: var GGUF_URL = process.env.EXE_EMBED_MODEL_URL ?? ""; L38: var EXPECTED_SHA256 = process.env.EXE_EMBED_MODEL_SHA256 ?? ""; ... L107: resetInactivityTimer(); L108: if (!fileStream.write(value)) { L109: await new Promise((resolve) => fileStream.once("drain", resolve)); ... L138: if (attempt < MAX_RETRIES) { L139: process.stderr.write(` L140: Download attempt ${attempt} failed, retrying...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-4XIHTE2R.jsView on unpkg · L25

dist/bin/install.jsView file

96Install-time AI-agent control hijack evidence: L170: // src/bin/install.ts L171: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L172: import { spawn, execSync } from "child_process"; ... L391: if (!existsSync(plistDir)) { L392: mkdirSync(plistDir, { recursive: true }); L393: } ... L410: } L411: writeFileSync(newPlistPath, finalPlistContent); L412: if (!reload) { ... L430: const binDir = path.join(home, ".exe-os", "bin"); L431: mkdirSync(binDir, { recursive: true }); L432: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L96: import { fileURLToPath } from "url"; L97: import { spawn as spawnAsync } from "child_process"; L98: import { e

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/bin/install.jsView on unpkg · L96

dist/chunk-4KNPF6RI.jsView file

893Cross-file remote execution chain: dist/chunk-4KNPF6RI.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L893: agent_role: agentRole, L894: session_id: process.env.SESSION_ID ?? "manual", L895: timestamp: (/* @__PURE__ */ new Date()).toISOString(), ... L1003: } catch (err) { L1004: process.stderr.write( L1005: `[commit-memory] Failed to archive superseded memory ${supersedes_id}: ${err instanceof Error ? err.message : String(err)} ... L2373: try { L2374: const receipts = JSON.parse(String(row.verification_receipts)); L2375: if (Array.isArray(receipts) && receipts.length > 0) { ... L2429: process.stderr.write( L2430: `[close-task] respawn SKIPPED for ${input.assignee}: task has no project_name to resolve \u2014 never respawning into process.cwd().

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-4KNPF6RI.jsView on unpkg · L893

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/chunk-5KLQCGI5.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/chunk-5KLQCGI5.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-5KLQCGI5.jsView on unpkg

dist/hooks/session-end.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/hooks/session-end.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/session-end.jsView on unpkg

dist/bin/customer-readiness.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/customer-readiness.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/customer-readiness.jsView on unpkg

dist/bin/exe-call.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-call.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-call.jsView on unpkg