@askexenow/exe-os@0.9.359: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@askexenow/exe-os@0.9.359: AI-agent control-surface risk | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = [ ! -f dist/bin/install.js ] || node dist/bin/install.js --commands-only || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = [ ! -f dist/bin/install.js ] || node dist/bin/install.js --commands-only || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/chunk-74R44E4S.jsView file

107// src/lib/tmux-routing.ts L108: import { execFile as execFile2, execFileSync as execFileSync3 } from "child_process"; L109: import { promisify as promisify3 } from "util"; ... L119: import os from "os"; L120: var CACHE_DIR = path.join(os.homedir(), ".exe-os", "cache"); L121: var _cached = null; ... L177: opencode: { L178: baseUrl: "https://opencode.ai/zen/go", L179: apiKeyEnv: "OPENCODE_API_KEY", ... L183: var DEFAULT_PROVIDER = "default"; L184: function detectActiveProvider(env = process.env) { L185: const baseUrl = env.ANTHROPIC_BASE_URL;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-74R44E4S.jsView on unpkg · L107

dist/chunk-TG7JYSEA.jsView file

49if (process.platform === "linux") { L50: execFileSync("notify-send", [safeTitle, safeBody], { L51: timeout: DESKTOP_TIMEOUT_MS, ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-TG7JYSEA.jsView on unpkg · L49

5// src/lib/push-notifications.ts L6: import { execSync, execFileSync } from "child_process"; L7: import nodemailer from "nodemailer"; ... L48: } L49: if (process.platform === "linux") { L50: execFileSync("notify-send", [safeTitle, safeBody], { ... L57: } catch (err) { L58: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L59: `); ... L64: try { L65: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L66: const res = await fetch(url, {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-TG7JYSEA.jsView on unpkg · L5

dist/bin/install.jsView file

103Install-time AI-agent control hijack evidence: L180: // src/bin/install.ts L181: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L182: import { spawn, execSync } from "child_process"; ... L372: if (!existsSync(plistDir)) { L373: mkdirSync(plistDir, { recursive: true }); L374: } ... L391: } L392: writeFileSync(newPlistPath, finalPlistContent); L393: if (!reload) { ... L411: const binDir = path.join(home, ".exe-os", "bin"); L412: mkdirSync(binDir, { recursive: true }); L413: const shimPath = path.join(binDir, "exe-os-node"); Payload evidence from dist/bin/exe-launch-agent.js: L103: import { fileURLToPath } from "url"; L104: import { spawn as spawnAsync } from "child_process"; L105: import

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/bin/install.jsView on unpkg · L103

dist/bin/deferred-daemon-restart.jsView file

154Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L154: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L155: import { spawn, execSync } from "child_process"; L156: import path from "path"; L157: import os from "os"; L158: var EXE_DIR = path.join(os.homedir(), ".exe-os"); L159: var DAEMON_PORT = 48739; ... L163: try { L164: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L165: return pkg.version; ... L184: versionMismatchWarned = true; L185: process.stderr.write( L186: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L154

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10038 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/chunk-5KLQCGI5.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/chunk-5KLQCGI5.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-5KLQCGI5.jsView on unpkg

dist/bin/customer-readiness.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/customer-readiness.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/customer-readiness.jsView on unpkg

dist/bin/exe-call.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-call.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-call.jsView on unpkg

dist/bin/exe-rename.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.336 matchedPath = dist/bin/exe-rename.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.336 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-rename.jsView on unpkg