Loading npm security reports…

@askexenow/exe-os@0.9.405: AI-agent control-surface risk | LPM Firewall

registry / @askexenow/exe-os / 0.9.405

@askexenow/exe-os@0.9.405

AI employee operating system — persistent memory, task management, and multi-agent coordination for Claude Code.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall unconditionally refreshes Claude Code skills in the user home .claude/skills tree. When a prior exe-os setup marker exists, the same install also rewrites global Claude MCP and hook configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install or update runs the package postinstall lifecycle, which executes install.js --commands-only.

Impact

A normal package install changes Claude Code's skill, MCP, and hook control surface without a separate consent prompt at install time, so later Claude sessions load this package's agent instructions and hook commands.

Mechanism

The installer copies package command markdown into ~/.claude/skills and, after detecting setup-state.json or config.json on a canonical root, registers an MCP server in ~/.claude.json and merges command hooks into ~/.claude/settings.json.

Policy narrative

Installing @askexenow/exe-os runs postinstall.mjs, which launches dist/bin/install.js --commands-only. That path copies slash-command skills into ~/.claude/skills before any setup check. If ~/.exe-os already has setup state and this tree is the canonical install, it also registers the package MCP server in ~/.claude.json and merges hook commands into ~/.claude/settings.json. Those hooks invoke package scripts on Claude tool, prompt, and session events. The install itself is the consent boundary; no separate prompt gates the skill write.

AI rationale

Postinstall always writes Claude Code skill files under the user home, and after a prior setup marker it also rewrites Claude MCP and hook settings. That is unconsented install-time mutation of a foreign agent control surface.

Evidence

package.jsonpostinstall.mjsdist/bin/install.js

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/stack-generate-manifest-WGOICIAB.jsView file

22// src/bin/stack-generate-manifest.ts L23: import { execFile as execFileCb } from "child_process"; L24: import { existsSync, readFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/stack-generate-manifest-WGOICIAB.jsView on unpkg · L22

dist/chunk-DFV4KVU7.jsView file

37import crypto from "crypto"; L38: import { execSync } from "child_process"; L39: import { existsSync as existsSync2, mkdirSync, readFileSync, unlinkSync as unlinkSync2, chmodSync } from "fs"; ... L48: import path from "path"; L49: var GGUF_URL = process.env.EXE_EMBED_MODEL_URL ?? ""; L50: var EXPECTED_SHA256 = process.env.EXE_EMBED_MODEL_SHA256 ?? ""; ... L119: resetInactivityTimer(); L120: if (!fileStream.write(value)) { L121: await new Promise((resolve) => fileStream.once("drain", resolve)); ... L150: if (attempt < MAX_RETRIES) { L151: process.stderr.write(` L152: Download attempt ${attempt} failed, retrying...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-DFV4KVU7.jsView on unpkg · L37

563const HEAP_FLAG_RE = /^--(max[-_]old[-_]space[-_]size|max[-_]semi[-_]space[-_]size|max[-_]heap[-_]size)(=|$)/i; L564: const execArgv = [ L565: ...process.execArgv.filter((a) => !HEAP_FLAG_RE.test(a)),

High

Shell

Package source references shell execution.

dist/chunk-DFV4KVU7.jsView on unpkg · L563

dist/stack-generate-manifest-WGOICIAB.js#virtual:normalized:round1View file

158return refuse( L159: facts.commitIsAncestorOfTag === false ? `commit ${facts.tagCommit} is NOT an ancestor of ${spec.ghRepo}@${facts.latestTag} \u2014 the image was built from code outside that release... L160: };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/stack-generate-manifest-WGOICIAB.js#virtual:normalized:round1View on unpkg · L158

dist/chunk-5V7BD7Z4.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/chunk-5V7BD7Z4.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-5V7BD7Z4.jsView on unpkg

12import { chmodSync, chownSync, readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs"; L13: import { execSync } from "child_process"; L14: import path from "path"; ... L221: function [redacted](opts = {}) { L222: const platformName = opts.platform ?? process.platform; L223: if (platformName !== "darwin") { ... L232: } L233: const env = opts.env ?? process.env; L234: const targetUser = env.SUDO_USER && env.SUDO_USER !== "root" ? env.SUDO_USER : ""; ... L348: try { L349: execSync(`launchctl bootout gui/${targetUid}/${label} 2>/dev/null`, { timeout: 5e3 }); L350: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-5V7BD7Z4.jsView on unpkg · L12

dist/bin/install.jsView file

260import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L261: import { spawn, execSync } from "child_process"; L262: import path from "path"; L263: import os from "os"; L264: var homedir = os.homedir; L265: function exeDir() { ... L277: try { L278: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L279: return pkg.version; ... L298: versionMismatchWarned = true; L299: process.stderr.write( L300: `exe-os: daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/install.jsView on unpkg · L260

260Trigger-reachable chain: manifest.bin -> dist/bin/install.js L260: import { existsSync, openSync, closeSync, writeFileSync, readFileSync, unlinkSync, statSync, mkdirSync, chmodSync, renameSync, readdirSync } from "fs"; L261: import { spawn, execSync } from "child_process"; L262: import path from "path"; L263: import os from "os"; L264: var homedir = os.homedir; L265: function exeDir() { ... L277: try { L278: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L279: return pkg.version; ... L298: versionMismatchWarned = true; L299: process.stderr.write( L300: `exe-os: daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/install.jsView on unpkg · L260

260

dist/installer-CHKYUF4F.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { resolvepackageroot } from "./chunk-fveayemk.js"; import { loadpreferences } from "./chunk-xbolfvmd.js"; import { exe_hooks, islegacysplitposttoolcommand } from "./chunk-km6xsfhp.js"; import { assertstablehookpath, extracthooktarget } from "./chunk-zppphvsu.js"; import { buildmcphttpheaders, mcphttpurl } from "./chunk-id3ktuxs.js"; import "./chunk-lcc7ss6f.js"; import "./chunk-nrljov7m.js"; import "./chunk-w76ifxgp.js"; import "./chunk-hyzv25ly.js"; import "./chunk-cvyc6duw.js"; import "./chunk-gjv3wdwm.js"; import "./chunk-ywh7xwox.js"; import "./chunk-bbmtvae3.js"; import "./chunk-tkditwdn.js"; import "./chunk-ximuzqjt.js"; import "./chunk-bu4nqu5r.js";

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/installer-CHKYUF4F.jsView on unpkg

dist/bin/deferred-daemon-restart.jsView file

217Cross-file remote execution chain: dist/bin/deferred-daemon-restart.js spawns dist/chunk-3OEVDGIY.js; helper contains network access plus dynamic code execution. L217: import { existsSync, openSync, closeSync, writeFileSync, unlinkSync, readFileSync } from "fs"; L218: import { spawn, execSync } from "child_process"; L219: import path from "path"; ... L232: try { L233: const pkg = JSON.parse(readFileSync(path.join(pkgRoot, "package.json"), "utf8")); L234: return pkg.version; ... L253: versionMismatchWarned = true; L254: process.stderr.write( L255: `[deferred-restart] daemon/client version mismatch (daemon ${daemonVersion}, client ${clientVersion}). Run: exe-os-install --global ... L261: const result2 = await new Promise((resolve) => { L262: const req = http.get(`http://127.0.0.1:${daemonPor

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/deferred-daemon-restart.jsView on unpkg · L217

dist/bin/exe-start.shView file

•path = dist/bin/exe-start.sh kind = build_helper sizeBytes = 10931 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bin/exe-start.shView on unpkg

deploy/compose/generate-env.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

deploy/compose/generate-env.ts#virtual:normalized:round1View on unpkg

dist/bin/update.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/update.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/update.jsView on unpkg

dist/chunk-GER43BIE.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/chunk-GER43BIE.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-GER43BIE.jsView on unpkg

dist/chunk-LRRPSQ25.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/chunk-AR2K7SUC.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-LRRPSQ25.jsView on unpkg

dist/bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/cli.jsView on unpkg

dist/bin/codex-reviewd-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/codex-reviewd-cli.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/codex-reviewd-cli.jsView on unpkg

dist/bin/exe-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/exe-agent.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-agent.jsView on unpkg

dist/bin/exe-cicd.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/exe-cicd.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-cicd.jsView on unpkg

dist/bin/exe-launch-agent.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/exe-launch-agent.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-launch-agent.jsView on unpkg

dist/bin/exe-rename.jsView file

•matchType = normalized_sha256 matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/exe-rename.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-rename.jsView on unpkg

dist/bin/exe-start-codex.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/bin/exe-start-codex.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/exe-start-codex.jsView on unpkg

dist/chunk-56XINHPT.jsView file

•matchType = token_shingles matchedPackage = @askexenow/exe-os@0.9.402 matchedPath = dist/chunk-ROGZRDCU.js matchedIdentity = npm:QGFza2V4ZW5vdy9leGUtb3M:0.9.402 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-56XINHPT.jsView on unpkg