registry  /  @bolloon/bolloon-agent  /  0.2.3

@bolloon/bolloon-agent@0.2.3

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The package is a P2P/AI document agent with broad runtime capabilities, but the risky paths are user-invoked product functions rather than install-time or import-time abuse.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs bolloon CLI or explicit update/harness commands
Impact
Package-aligned local agent behavior; no confirmed credential harvesting, exfiltration, persistence, or unconsented AI-agent control mutation
Mechanism
CLI launches packaged agent; optional runtime network, file storage, P2P, and update operations
Rationale
Static inspection found high-risk primitives, but they are aligned with an AI document/P2P agent and are activated by explicit CLI/runtime commands; the declared postinstall target is missing rather than a malicious installer. No concrete install-time/import-time credential theft, exfiltration, persistence, destructive behavior, or unconsented AI-agent control-surface mutation was confirmed.
Evidence
package.jsonbin/bolloon-cli.cjsdist/cli-entry.jsdist/index.jsdist/utils/auto-update.jsdist/security/input-scanner.jsdist/heartbeat/StartupVerifier.jsbin/ipfsAGENTS.mdCLAUDE.md~/.bolloon
Network endpoints5
registry.npmjs.org/127.0.0.1:5001127.0.0.1:8080www.google.com/generate_204api.openai.com/v1

Decision evidence

public snapshot
AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json defines postinstall as node scripts/postinstall.js, but scripts/postinstall.js is absent from package files
  • dist/index.js has user-invoked harness commands that append to AGENTS.md and CLAUDE.md in cwd
  • dist/utils/auto-update.js can run npm install -g only via explicit update flags/commands
  • bin/ipfs is a bundled Mach-O native binary
Evidence against
  • bin/bolloon-cli.cjs and dist/cli-entry.js only spawn the package's own dist/electron.js or dist/index.js on CLI invocation
  • No install-time source file exists to harvest credentials or mutate AI-agent control files
  • Network endpoints observed are product-aligned: localhost/IPFS, npm registry update check, OpenAI-compatible API, Google connectivity check
  • dist/security/input-scanner.js hidden Unicode is part of regex/range logic for detecting hidden characters, not Trojan-source control flow
  • File writes are runtime/product storage under ~/.bolloon or explicit document/agent commands, not import-time exfiltration
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 252 file(s), 2.08 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.xiaomi.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, esm.sh, eth.llamarpc.com, example.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn, openclaw.ai, openrouter.ai, platform.minimaxi.com, registry.npmjs.org, www.google.com, www.volcengine.com

Source & flagged code

8 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/bolloon.cjsView file
1#!/usr/bin/env node L2: const path = require("path"); L3: const { spawn } = require("child_process");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1
dist/heartbeat/StartupVerifier.jsView file
89package = @bolloon/bolloon-agent; repositoryIdentity = bolloon; dependency = @diap/sdk L89: try { L90: await import('@diap/sdk'); L91: this.completeCheck('p2p_modules', true, '@diap/sdk available');
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/heartbeat/StartupVerifier.jsView on unpkg · L89
dist/security/input-scanner.jsView file
56contains invisible/control Unicode U+200B (zero width space) const WHITESPACE_ANOMALY_RE = /[<U+200B>-<U+200F><U+FEFF>]{5,}/g;
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/input-scanner.jsView on unpkg · L56
bin/ipfsView file
•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg
bin/bolloon.cmdView file
•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg
dist/web/icons/favicon.icnsView file
•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

Findings

1 Critical3 High7 Medium4 Low
CriticalTrojan Source Unicodedist/security/input-scanner.js
HighInstall Time Lifecycle Scriptspackage.json
HighCopied Package Dependency Bridgedist/heartbeat/StartupVerifier.js
HighShips High Entropy Blobdist/web/icons/favicon.icns
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/bolloon.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarybin/ipfs
MediumShips Build Helperbin/bolloon.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings