registry / @bolloon/bolloon-agent / 0.2.4

@bolloon/bolloon-agent@0.2.4

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

AI Security Review

scanned 6d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The package is an AI/P2P agent with user-invoked shell, update, network, and harness features, plus a broken postinstall declaration.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User invokes bolloon or explicit harness/update commands; npm install attempts a missing postinstall target.

Impact

No confirmed unconsented exfiltration, persistence, destructive behavior, or install-time AI-agent control hijack.

Mechanism

user-invoked agent runtime with guarded shell and optional update paths

Rationale

The risky primitives are consistent with the package's AI agent/P2P/document-tool purpose and are activated by user commands or explicit opt-in flags; the declared lifecycle hook points to a missing file rather than a malicious payload. Static inspection did not find concrete credential exfiltration, persistence, destructive install behavior, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonbin/bolloon-cli.cjsbin/bolloon.cjsdist/cli-entry.jsdist/index.jsdist/agents/shell-tool.jsdist/agents/shell-guard.jsdist/utils/auto-update.jsdist/heartbeat/StartupVerifier.jsdist/security/input-scanner.jsAGENTS.mdCLAUDE.md~/.bolloon/self-improve-policy.json~/.bolloon/self-improve-audit.log~/.bolloon/sessions/*.jsonl

Network endpoints6

127.0.0.1:5001127.0.0.1:8080registry.npmjs.org/api.openai.com/v1api.minimaxi.com/v1www.google.com/generate_204

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json declares postinstall: node scripts/postinstall.js, but scripts/ is absent in packed files.
dist/index.js appends to cwd AGENTS.md on explicit harness-init and CLAUDE.md on explicit harness-classify.
dist/agents/shell-tool.js exposes shell execution for the agent runtime, guarded by dist/agents/shell-guard.js allow/deny lists.
dist/utils/auto-update.js can run npm install -g, but only with update flags or BOLLOON_AUTO_UPDATE=1.

Evidence against

No bundled install-time code target exists for the declared postinstall hook.
bin/bolloon-cli.cjs and dist/cli-entry.js only spawn packaged runtime/electron after user invokes bolloon.
No credential harvesting or secret exfiltration found; API keys are read for configured LLM use.
Network endpoints found are product-aligned/local: IPFS localhost, npm registry, OpenAI/minimax, Google connectivity check.
AGENTS.md/CLAUDE.md writes are tied to explicit harness commands, not lifecycle/import-time mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 252 file(s), 2.08 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.xiaomi.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, esm.sh, eth.llamarpc.com, example.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn, openclaw.ai, openrouter.ai, platform.minimaxi.com, registry.npmjs.org, www.google.com, www.volcengine.com

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "scripts": {

21 "build": "npm run build --workspaces --if-present",

22 "build:main": "tsc",

23 "build:cli": "node scripts/build-cli.js",

24 "build:web": "npx tsx scripts/build-web.ts",

25 "build:electron": "tsc -p tsconfig.electron.json",

26 "build:all": "npm run build:main && npm run build:web && npm run build:electron && npm run build:cli",

27 "start": "node dist/index.js",

28 "dev": "tsx -r dotenv/config src/index.ts",

29 "dev:web": "npm run build:web && tsx -r dotenv/config src/index.ts --web",

30 "dev:electron": "npm run build:electron && npm run electron:start",

31 "electron:start": "NODE_ENV=development electron dist/electron.js",

32 "electron:dev": "concurrently \"npm run dev:web\" \"npm run electron:start\"",

33 "electron:build": "npm run build:electron && electron-builder",

34 "electron:pack": "electron-builder --dir",

35 "app:bundle": "node scripts/build-app-bundle.cjs",

36 "app:bundle:open": "node scripts/build-app-bundle.cjs && open \"release/mac-arm64/Bolloon Agent.app\"",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "test:pi-sdk": "tsx src/test/pi-sdk.test.ts",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "workspaces": [

43 "src/constraint-runtime"

44 ],

45 "dependencies": {

46 "@bolloon/bolloon-agent": "^0.1.36",

47 "@bolloon/constraint-runtime": "0.1.0",

48 "@capacitor/core": "^8.4.1",

49 "@capacitor/ios": "^8.4.1",

50 "@chainsafe/libp2p-noise": "^17.0.0",

51 "@chainsafe/libp2p-yamux": "^8.0.1",

52 "@diap/sdk": "^0.1.10",

53 "@libp2p/autonat": "^3.0.20",

54 "@libp2p/circuit-relay-v2": "^4.2.5",

55 "@libp2p/dcutr": "^3.0.20",

56 "@libp2p/identify": "^4.1.6",

57 "@libp2p/kad-dht": "^16.2.6",

58 "@libp2p/tcp": "^11.0.20",

59 "@libp2p/upnp-nat": "^4.0.20",

60 "@multiformats/multiaddr": "^13.0.3",

bin/bolloon.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require("path");

3const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

4const fs = require

dist/heartbeat/StartupVerifier.jsView file

Lines 69-109javascript

69 }

70 // 3. 检查 LLM 配置

71 this.addCheck('llm_config');

72 this.startCheck('llm_config');

73 const hasLlmKey = !!(process.env.OPENAI_API_KEY ||

dist/security/input-scanner.jsView file

Lines 36-76javascript

36 { kind: 'pii-privatekey', re: /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/g },

37 { kind: 'secret-aws', re: /AKIA[0-9A-Z]{16}/g },

38 { kind: 'secret-github',

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

bin/bolloon-cli.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bolloon/bolloon-agent@0.2.3 matchedIdentity = npm:QGJvbGxvb24vYm9sbG9vbi1hZ2VudA:0.2.3 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/bolloon-cli.cjsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bolloon.cjsView file

1#!/usr/bin/env node L2: const path = require("path"); L3: const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

dist/heartbeat/StartupVerifier.jsView file

89package = @bolloon/bolloon-agent; repositoryIdentity = bolloon; dependency = @diap/sdk L89: try { L90: await import('@diap/sdk'); L91: this.completeCheck('p2p_modules', true, '@diap/sdk available');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/heartbeat/StartupVerifier.jsView on unpkg · L89

dist/security/input-scanner.jsView file

56contains invisible/control Unicode U+200B (zero width space) const WHITESPACE_ANOMALY_RE = /[<U+200B>-<U+200F><U+FEFF>]{5,}/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/input-scanner.jsView on unpkg · L56

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

bin/bolloon-cli.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/bolloon-cli.cjsView on unpkg

Findings

2 Critical3 High7 Medium4 Low

CriticalTrojan Source Unicodedist/security/input-scanner.js

CriticalPrevious Version Dangerous Deltabin/bolloon-cli.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/heartbeat/StartupVerifier.js

HighShips High Entropy Blobdist/web/icons/favicon.icns

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/bolloon.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/ipfs

MediumShips Build Helperbin/bolloon.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "scripts": {

21 "build": "npm run build --workspaces --if-present",

22 "build:main": "tsc",

23 "build:cli": "node scripts/build-cli.js",

24 "build:web": "npx tsx scripts/build-web.ts",

25 "build:electron": "tsc -p tsconfig.electron.json",

26 "build:all": "npm run build:main && npm run build:web && npm run build:electron && npm run build:cli",

27 "start": "node dist/index.js",

28 "dev": "tsx -r dotenv/config src/index.ts",

29 "dev:web": "npm run build:web && tsx -r dotenv/config src/index.ts --web",

30 "dev:electron": "npm run build:electron && npm run electron:start",

31 "electron:start": "NODE_ENV=development electron dist/electron.js",

32 "electron:dev": "concurrently \"npm run dev:web\" \"npm run electron:start\"",

33 "electron:build": "npm run build:electron && electron-builder",

34 "electron:pack": "electron-builder --dir",

35 "app:bundle": "node scripts/build-app-bundle.cjs",

36 "app:bundle:open": "node scripts/build-app-bundle.cjs && open \"release/mac-arm64/Bolloon Agent.app\"",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "test:pi-sdk": "tsx src/test/pi-sdk.test.ts",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "workspaces": [

43 "src/constraint-runtime"

44 ],

45 "dependencies": {

46 "@bolloon/bolloon-agent": "^0.1.36",

47 "@bolloon/constraint-runtime": "0.1.0",

48 "@capacitor/core": "^8.4.1",

49 "@capacitor/ios": "^8.4.1",

50 "@chainsafe/libp2p-noise": "^17.0.0",

51 "@chainsafe/libp2p-yamux": "^8.0.1",

52 "@diap/sdk": "^0.1.10",

53 "@libp2p/autonat": "^3.0.20",

54 "@libp2p/circuit-relay-v2": "^4.2.5",

55 "@libp2p/dcutr": "^3.0.20",

56 "@libp2p/identify": "^4.1.6",

57 "@libp2p/kad-dht": "^16.2.6",

58 "@libp2p/tcp": "^11.0.20",

59 "@libp2p/upnp-nat": "^4.0.20",

60 "@multiformats/multiaddr": "^13.0.3",

bin/bolloon.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require("path");

3const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

4const fs = require

dist/heartbeat/StartupVerifier.jsView file

Lines 69-109javascript

69 }

70 // 3. 检查 LLM 配置

71 this.addCheck('llm_config');

72 this.startCheck('llm_config');

73 const hasLlmKey = !!(process.env.OPENAI_API_KEY ||

dist/security/input-scanner.jsView file

Lines 36-76javascript

36 { kind: 'pii-privatekey', re: /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/g },

37 { kind: 'secret-aws', re: /AKIA[0-9A-Z]{16}/g },

38 { kind: 'secret-github',

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

bin/bolloon-cli.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

bin/bolloon-cli.cjsView on unpkg