Loading npm security reports…

@askexenow/exe-os@0.9.372: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.372

@askexenow/exe-os@0.9.372

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs postinstall, which writes package-controlled skills into Claude Code’s global skill directory. On already configured systems it also registers MCP and broad event hooks that execute package code.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install or npm update

Impact

Package-controlled instructions and executables become available or run in future Claude sessions.

Mechanism

unconsented lifecycle mutation of Claude Code configuration and skills

Policy narrative

npm executes postinstall, which starts dist/bin/install.js with --commands-only. That path always copies package-controlled command markdown into the user’s global ~/.claude/skills directory. If prior exe-os setup state exists, it additionally writes MCP configuration and hook registrations; the hooks invoke package code on Claude prompt and tool events. This is an unconsented install-time mutation of a foreign, broad AI-agent control surface.

Rationale

The lifecycle behavior is concrete and reaches global Claude Code skill/configuration surfaces without an explicit user command. This meets the firewall block policy irrespective of the absence of a confirmed remote payload.

Evidence

package.jsonpostinstall.mjsdist/bin/install.jsdist/chunk-JR23BL74.jssrc/commands/exe.md~/.claude/skills/exe-*/SKILL.md~/.claude.json~/.claude/settings.json

Source & flagged code

23 flagged

package.jsonView file

Lines 99-139json

99 "@opentelemetry/exporter-metrics-otlp-grpc": ">=0.219.0",

100 "@opentelemetry/exporter-metrics-otlp-http": ">=0.219.0",

101 "@opentelemetry/exporter-metrics-otlp-proto": ">=0.219.0",

102 "@opentelemetry/exporter-prometheus": ">=0.219.0",

103 "@opentelemetry/exporter-trace-otlp-grpc": ">=0.219.0",

104 "@opentelemetry/exporter-trace-otlp-http": ">=0.219.0",

105 "@opentelemetry/exporter-trace-otlp-proto": ">=0.219.0"

106 },

107 "engines": {

108 "node": ">=20.0.0"

109 },

110 "scripts": {

111 "prepare": "git config core.hooksPath .githooks || true",

112 "test": "vitest run",

113 "test:watch": "vitest",

114 "lint": "eslint src/ --max-warnings 53",

115 "typecheck": "tsc --noEmit",

116 "typecheck:workers": "tsc --noEmit -p api-router/tsconfig.json && tsc --noEmit -p api-router/tsconfig.test.json && tsc --noEmit -p worker/tsconfig.json",

117 "build": "node scripts/dist-ownership-guard.mjs && bash scripts/build-lock.sh && mkdir -p dist/assets && cp src/assets/tmux.conf dist/assets/ && cp src/assets/ghostty.conf dist/assets/ && cp src/assets/statusline-command.sh dist/assets/ && cp src/assets/wezterm.lua dist/assets/ && cp src/assets/com.askexe.exed.plist dist/assets/ && cp src/bin/exe-start.sh dist/bin/exe-start.sh && (node dist/bin/generate-hook-manifest.js 2>/dev/null || true) && node scripts/dist-integrity.mjs --record",

118 "deploy": "node dist/bin/pre-build-guard.js && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node scripts/dist-integrity.mjs --verify && (node dist/bin/prune-orphan-chunks.js || true) && npm install -g . && node dist/bin/install.js --global && echo '[exe-os] Deploy complete. Run /mcp in active sessions to reconnect.'",

119 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L119

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L119

120 "prepublishOnly": "npm run typecheck && EXE_DIST_OP_RESTARTS_DAEMON=1 EXE_DIST_CLEAN=1 npm run build && node dist/bin/prune-orphan-chunks.js --force && node scripts/dist-integrity.mjs --prune && npm run guard:esm-require && npm run guard:defect-classes && npm run check:schema-version && node dist/bin/customer-readiness.js && node dist/bin/pre-publish.js",

121 "test:publish": "npx vitest run --maxWorkers=4 --exclude 'tests/tui/**' --exclude 'tests/lib/tmux-routing.test.ts' --exclude 'tests/lib/intercom-routing.test.ts' --exclude 'tests/gateway/**' --exclude 'tests/mcp/ingest-document.test.ts' --exclude 'tests/lib/hybrid-search.test.ts' --exclude 'tests/lib/worker-gate.test.ts' --exclude 'tests/daemon-perf-stress.test.ts' --exclude 'tests/lib/gateway-client.test.ts' --exclude 'tests/lib/ws-client.test.ts' --exclude 'tests/lib/ws-auth.test.ts' --exclude 'tests/integration/clean-stack-projection.test.ts' --exclude 'tests/orchestration/dispatch-chai ...

122 "benchmark:longmemeval": "npx tsx tests/benchmarks/longmemeval.ts",

123 "guard:esm-require": "node scripts/check-no-runtime-require.mjs",

124 "guard:defect-classes": "node scripts/check-defect-gates.mjs",

125 "guard:required-checks": "node scripts/check-required-checks-evaluable.mjs",

126 "check:schema-version": "node scripts/check-schema-version.mjs",

127 "check:perms-ui-sync": "node packages/permissions-ui/sync.mjs --check",

128 "check:switcher-ui-sync": "node packages/exe-service-switcher/sync.mjs --check",

129 "check:stack-manifest-signature": "node scripts/verify-stack-manifest-signature.mjs",

130 "check:sso-cookie-contract": "node scripts/sso-cookie-contract-check.mjs",

131 "check:delivery-liveness": "node scripts/delivery-liveness-check.mjs",

132 "test:stack-sim": "node scripts/stack-sim.mjs",

133 "test:daemon-smoke": "vitest run --maxWorkers=1 tests/smoke/daemon-smoke-gate.test.ts",

134 "test:smoke": "vitest run --maxWorkers=1 tests/smoke/",

135 "smoke:runtime": "node --import tsx src/bin/runtime-smoke.ts"

136 },

137 "dependencies": {

138 "@anthropic-ai/sdk": "^0.95.2",

139 "@aws-sdk/client-s3": "^3.1052.0",

Long lines were clipped for display.

dist/chunk-75H4R62K.jsView file

Lines 1-21javascript

1// src/lib/cc-binary-detect.ts

2import { execSync } from "child_process";

3import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

4import path from "path"

dist/chunk-HV6Y6F4X.jsView file

Lines 664-704javascript

664function formatForcePushBlockMessage(verb = "force/delete push to main") {

665 return `\u{1F6AB} BLOCKED: ${verb} would overwrite SHARED history on origin \u2014 it can silently discard commits other people (and other agents) pushed.

666WHY: --force / --force-with-lease / --mirror / +refspec / --delete rewrites the remote branch everyone builds on (bug 6aaea78f).

667

dist/projection-worker-D2472IOD.jsView file

Lines 13-53javascript

13 loadConfig

14} from "./chunk-QMSEL5YS.js";

15import "./chunk-HSGBZSCA.js";

16import "./chunk-JKKZGDLP.js";

17import "./chunk-MLKGABMK.js";

19// src/lib/projection-worker.ts

dist/chunk-5V7BD7Z4.jsView file

Lines 1-32javascript

1import {

2 resolveEmbeddingsEnabled

3} from "./chunk-KWOAM7TA.js";

4import {

5 computeDaemonHeapCapMb

6} from "./chunk-NLEW62VC.js";

7import {

dist/project-boot-LXLU2J32.jsView file

Lines 1-29javascript

1import {

2 EXE_AI_DIR

3} from "./chunk-QMSEL5YS.js";

4import "./chunk-HSGBZSCA.js";

5import "./chunk-JKKZGDLP.js";

6import "./chunk-MLKGABMK.js";

dist/chunk-LAZKEJMS.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-LAZKEJMS.js: import { writeFileSync } from "fs"; writeFileSync(flagPath, "1"); import { writeFileSync as writeFileSync2 } from "fs"; writeFileSync2(flagPath, "1"); `[close-task] respawn SKIPPED for ${input.assignee}: could not resolve project dir for "${input.projectName}" in scope ${exeSession} \u2014 never respawning into process.cwd(). Man... import { chmodSync, existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync } from "fs"; var GRAPH_API_BASE = `https://graph.facebook.com/${GRAPH_API_VERSION}`; `Insecure Company Brain gateway URL rejected: "${gatewayUrl}". Bearer tokens require https:// for r

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-LAZKEJMS.jsView on unpkg

996Cross-file remote execution chain: dist/chunk-LAZKEJMS.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L996: agent_role: agentRole, L997: session_id: process.env.SESSION_ID ?? "manual", L998: timestamp: (/* @__PURE__ */ new Date()).toISOString(), ... L1106: } catch (err) { L1107: process.stderr.write( L1108: `[commit-memory] Failed to archive superseded memory ${supersedes_id}: ${err instanceof Error ? err.message : String(err)} ... L2514: try { L2515: const receipts = JSON.parse(String(row.verification_receipts)); L2516: if (Array.isArray(receipts) && receipts.length > 0) { ... L2570: process.stderr.write( L2571: `[close-task] respawn SKIPPED for ${input.assignee}: task has no project_name to resolve \u2014 never respawning into process.cwd().

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-3KTQWMHI.jsView file

Lines 32-72javascript

32}

33function sendDesktopNotification(title, body, sessionScope) {

34 try {

35 const safeTitle = title.replace(/

dist/bin/install.jsView file

236import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L237: import { spawn, execSync } from "child_process"; L238: import path from "path"; L239: import os from "os"; L240: var homedir = os.homedir; L241: function exeDir() { ... L251: try { L252: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L253: return pkg.version; ... L272: versionMismatchWarned = true; L273: process.stderr.write( L274: `exe-os: daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/install.jsView on unpkg · L236

236Trigger-reachable chain: manifest.bin -> dist/bin/install.js L236: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L237: import { spawn, execSync } from "child_process"; L238: import path from "path"; L239: import os from "os"; L240: var homedir = os.homedir; L241: function exeDir() { ... L251: try { L252: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L253: return pkg.version; ... L272: versionMismatchWarned = true; L273: process.stderr.write( L274: `exe-os: daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/install.jsView on unpkg · L236

236

dist/installer-OC5VXNC7.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { resolvepackageroot } from "./chunk-jr23bl74.js"; import { loadpreferences } from "./chunk-xbolfvmd.js"; import { exe_hooks, islegacysplitposttoolcommand } from "./chunk-km6xsfhp.js"; import { buildmcphttpheaders, mcphttpurl } from "./chunk-ldl3s7ac.js"; import "./chunk-b6ti3tzt.js"; import "./chunk-waekyktk.js"; import "./chunk-hyzv25ly.js"; import "./chunk-5dcckhdy.js"; import "./chunk-tkditwdn.js"; import "./chunk-bbmtvae3.js"; import "./chunk-5yeupuv4.js"; import "./chunk-utdmtqnh.js"; import "./chunk-yyb5pmtk.js"; import "./chunk-njfjwqnn.js"; import "./chunk-v3w3sata.js"; import "./chunk-jy5gazyc.js"; import "./chunk-fxu7joxk.js"; import "./chunk-qmsel5

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/installer-OC5VXNC7.jsView on unpkg

dist/bin/update.jsView file

150try { L151: execSync(`npm install -g @askexenow/exe-os@${manifest.version}`, { L152: stdio: ["pipe", "pipe", "inherit"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/update.jsView on unpkg · L150

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

dist/bin/deferred-daemon-restart.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.371 matchedPath = dist/bin/deferred-daemon-restart.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.371 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/deferred-daemon-restart.jsView on unpkg

dist/bin/exe-watchdog.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.371 matchedPath = dist/bin/exe-watchdog.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.371 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-watchdog.jsView on unpkg

dist/chunk-QLA3RTH4.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.370 matchedPath = dist/chunk-MZVEUPJA.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.370 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-QLA3RTH4.jsView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.371 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.371 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-75H4R62K.jsView file

1// src/lib/cc-binary-detect.ts L2: import { execSync } from "child_process"; L3: import { existsSync, readFileSync, readdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-75H4R62K.jsView on unpkg · L1

dist/chunk-HV6Y6F4X.jsView file

684WHY: exe-os fails CLOSED here \u2014 a compound/wrapped command can move HEAD before a check runs, so an unverifiable destructive-git command is denied rather than parsed permissiv... L685: SAFE ALTERNATIVE: run the git command as a SINGLE, non-compound invocation with a bare 'git' program (no sh -c, no wrapper, no path), no shell operators, no comment, at most one -C... L686: ${OVERRIDE_LINE}`;

High

Shell

Package source references shell execution.

dist/chunk-HV6Y6F4X.jsView on unpkg · L684

dist/projection-worker-D2472IOD.jsView file

33if (explicitPath) { L34: const mod = await import(pathToFileURL(explicitPath).href); L35: const Ctor = mod.PrismaClient ?? mod.default?.PrismaClient;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/projection-worker-D2472IOD.jsView on unpkg · L33

dist/chunk-5V7BD7Z4.jsView file

12import { chmodSync, chownSync, readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L221: function [redacted](opts = {}) { L222: const platformName = opts.platform ?? process.platform; L223: if (platformName !== "darwin") { ... L232: } L233: const env = opts.env ?? process.env; L234: const targetUser = env.SUDO_USER && env.SUDO_USER !== "root" ? env.SUDO_USER : ""; ... L348: try { L349: execSync(`launchctl bootout gui/${targetUid}/${label} 2>/dev/null`, { timeout: 5e3 }); L350: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-5V7BD7Z4.jsView on unpkg · L12

dist/project-boot-LXLU2J32.jsView file

9import path from "path"; L10: import { execSync } from "child_process"; L11: import { existsSync, readFileSync } from "fs"; L12: import net from "net"; L13: var DAEMON_URL = "http://127.0.0.1:48739"; L14: var EXE_DIR = process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(process.env.HOME ?? "/tmp", ".exe-os"); L15: var SOCK_PATH = path.join(EXE_DIR, "exed.sock");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/project-boot-LXLU2J32.jsView on unpkg · L9

dist/chunk-LAZKEJMS.jsView file

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-LAZKEJMS.jsView on unpkg

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-3KTQWMHI.jsView file

52if (process.platform === "linux") { L53: execFileSync("notify-send", [safeTitle, safeBody], { L54: timeout: DESKTOP_TIMEOUT_MS, ... L60: } catch (err) { L61: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L62: `); ... L67: try { L68: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L69: const res = await fetch(url, {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/chunk-3KTQWMHI.jsView on unpkg · L52

8// src/lib/push-notifications.ts L9: import { execSync, execFileSync } from "child_process"; L10: import nodemailer from "nodemailer"; ... L51: } L52: if (process.platform === "linux") { L53: execFileSync("notify-send", [safeTitle, safeBody], { ... L60: } catch (err) { L61: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L62: `); ... L67: try { L68: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L69: const res = await fetch(url, {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-3KTQWMHI.jsView on unpkg · L8

52Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/mcp/server.js -> dist/chunk-HECXZGGZ.js -> dist/push-notifications-HR3FZRDI.js -> dist/chunk-3KTQWMHI.js L52: if (process.platform === "linux") { L53: execFileSync("notify-send", [safeTitle, safeBody], { L54: timeout: DESKTOP_TIMEOUT_MS, ... L60: } catch (err) { L61: process.stderr.write(`[push-notify] Desktop notification failed: ${err instanceof Error ? err.message : String(err)} L62: `); ... L67: try { L68: const url = `https://api.telegram.org/bot${botToken}/sendMessage`; L69: const res = await fetch(url, {