registry / @bolloon/bolloon-agent / 0.2.6

@bolloon/bolloon-agent@0.2.6

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established by source inspection. The package has broad AI-agent, local web, P2P, shell-tool, and update capabilities, but the reviewed paths are user-invoked or guarded and aligned with the package purpose.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

user runs bolloon CLI/web/electron or explicitly enables update/self-improve features

Impact

No confirmed credential theft, destructive action, persistence abuse, or unconsented agent control mutation found

Mechanism

local AI agent with P2P/IPFS/LLM integrations and guarded shell/self-improve APIs

Rationale

Static inspection found risky primitives, a broken postinstall reference, self-dependency, and a bundled native IPFS binary, but did not find install/import-time malicious execution, credential harvesting, exfiltration, destructive behavior, or unconsented AI-agent control-surface mutation. The suspicious primitives are consistent with a local P2P AI document agent and are mostly user-invoked or guarded.

Evidence

package.jsonbin/bolloon-cli.cjsbin/bolloon.cjsbin/ipfsdist/cli-entry.jsdist/web/server.jsdist/security/input-scanner.jsdist/agents/shell-tool.jsdist/agents/shell-guard.jsdist/utils/auto-update.jsdist/heartbeat/StartupVerifier.js~/.bolloon~/.bolloon/sessions~/.bolloon/self-improve-policy.json~/.bolloon/sessions/permission-mode.json

Network endpoints12

127.0.0.1:5001127.0.0.1:8080www.google.com/generate_204registry.npmjs.orgapi.openai.com/v1api.anthropic.com/v1openrouter.ai/api/v1generativelanguage.googleapis.com/v1betaapi.minimaxi.com/v1api.deepseek.com/v1api.moonshot.cn/v1open.bigmodel.cn/api/paas/v4

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with medium false-positive risk.

Evidence for block

package.json declares postinstall node scripts/postinstall.js but scripts/postinstall.js is absent, so install hook is broken rather than observed malicious code
package.json depends on @bolloon/bolloon-agent ^0.1.36 despite being the same package, an unusual self-dependency
bin/ipfs is a bundled Mach-O executable, but no package source path was found executing bin/ipfs

Evidence against

bin/bolloon-cli.cjs and dist/cli-entry.js only spawn node/electron entrypoints from this package on user CLI invocation
dist/security/input-scanner.js implements prompt/PII scanning; Unicode/control regexes are scanner logic, not Trojan Source behavior
dist/web/server.js writes app state under ~/.bolloon and exposes local product APIs; no credential harvesting or external exfiltration path found
dist/utils/auto-update.js is opt-in via flags or BOLLOON_AUTO_UPDATE=1 and targets the same @bolloon packages
dist/agents/shell-tool.js routes shell execution through dist/agents/shell-guard.js allow/deny checks
network use is product-aligned P2P/IPFS/LLM/local web functionality

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 254 file(s), 2.10 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.xiaomi.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, esm.sh, eth.llamarpc.com, example.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn, openclaw.ai, openrouter.ai, platform.minimaxi.com, registry.npmjs.org, www.google.com, www.volcengine.com

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "scripts": {

21 "build": "npm run build --workspaces --if-present",

22 "build:main": "tsc",

23 "build:cli": "node scripts/build-cli.js",

24 "build:web": "npx tsx scripts/build-web.ts",

25 "build:electron": "tsc -p tsconfig.electron.json",

26 "build:all": "npm run build:main && npm run build:web && npm run build:electron && npm run build:cli",

27 "start": "node dist/index.js",

28 "dev": "tsx -r dotenv/config src/index.ts",

29 "dev:web": "npm run build:web && tsx -r dotenv/config src/index.ts --web",

30 "dev:electron": "npm run build:electron && npm run electron:start",

31 "electron:start": "NODE_ENV=development electron dist/electron.js",

32 "electron:dev": "concurrently \"npm run dev:web\" \"npm run electron:start\"",

33 "electron:build": "npm run build:electron && electron-builder",

34 "electron:pack": "electron-builder --dir",

35 "app:bundle": "node scripts/build-app-bundle.cjs",

36 "app:bundle:open": "node scripts/build-app-bundle.cjs && open \"release/mac-arm64/Bolloon Agent.app\"",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "test:pi-sdk": "tsx src/test/pi-sdk.test.ts",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "workspaces": [

43 "src/constraint-runtime"

44 ],

45 "dependencies": {

46 "@bolloon/bolloon-agent": "^0.1.36",

47 "@bolloon/constraint-runtime": "0.1.0",

48 "@capacitor/core": "^8.4.1",

49 "@capacitor/ios": "^8.4.1",

50 "@chainsafe/libp2p-noise": "^17.0.0",

51 "@chainsafe/libp2p-yamux": "^8.0.1",

52 "@diap/sdk": "^0.1.10",

53 "@libp2p/autonat": "^3.0.20",

54 "@libp2p/circuit-relay-v2": "^4.2.5",

55 "@libp2p/dcutr": "^3.0.20",

56 "@libp2p/identify": "^4.1.6",

57 "@libp2p/kad-dht": "^16.2.6",

58 "@libp2p/tcp": "^11.0.20",

59 "@libp2p/upnp-nat": "^4.0.20",

60 "@multiformats/multiaddr": "^13.0.3",

bin/bolloon.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require("path");

3const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

4const fs = require

dist/heartbeat/StartupVerifier.jsView file

Lines 69-109javascript

69 }

70 // 3. 检查 LLM 配置

71 this.addCheck('llm_config');

72 this.startCheck('llm_config');

73 const hasLlmKey = !!(process.env.OPENAI_API_KEY ||

dist/security/input-scanner.jsView file

Lines 36-76javascript

36 { kind: 'pii-privatekey', re: /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/g },

37 { kind: 'secret-aws', re: /AKIA[0-9A-Z]{16}/g },

38 { kind: 'secret-github',

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

dist/web/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @bolloon/bolloon-agent@0.2.5 matchedIdentity = npm:QGJvbGxvb24vYm9sbG9vbi1hZ2VudA:0.2.5 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bolloon.cjsView file

1#!/usr/bin/env node L2: const path = require("path"); L3: const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

dist/heartbeat/StartupVerifier.jsView file

89package = @bolloon/bolloon-agent; repositoryIdentity = bolloon; dependency = @diap/sdk L89: try { L90: await import('@diap/sdk'); L91: this.completeCheck('p2p_modules', true, '@diap/sdk available');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/heartbeat/StartupVerifier.jsView on unpkg · L89

dist/security/input-scanner.jsView file

56contains invisible/control Unicode U+200B (zero width space) const WHITESPACE_ANOMALY_RE = /[<U+200B>-<U+200F><U+FEFF>]{5,}/g;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/input-scanner.jsView on unpkg · L56

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

dist/web/server.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg

Findings

1 Critical4 High7 Medium4 Low

CriticalTrojan Source Unicodedist/security/input-scanner.js

HighInstall Time Lifecycle Scriptspackage.json

HighCopied Package Dependency Bridgedist/heartbeat/StartupVerifier.js

HighShips High Entropy Blobdist/web/icons/favicon.icns

HighPrevious Version Dangerous Deltadist/web/server.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/bolloon.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarybin/ipfs

MediumShips Build Helperbin/bolloon.cmd

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "scripts": {

21 "build": "npm run build --workspaces --if-present",

22 "build:main": "tsc",

23 "build:cli": "node scripts/build-cli.js",

24 "build:web": "npx tsx scripts/build-web.ts",

25 "build:electron": "tsc -p tsconfig.electron.json",

26 "build:all": "npm run build:main && npm run build:web && npm run build:electron && npm run build:cli",

27 "start": "node dist/index.js",

28 "dev": "tsx -r dotenv/config src/index.ts",

29 "dev:web": "npm run build:web && tsx -r dotenv/config src/index.ts --web",

30 "dev:electron": "npm run build:electron && npm run electron:start",

31 "electron:start": "NODE_ENV=development electron dist/electron.js",

32 "electron:dev": "concurrently \"npm run dev:web\" \"npm run electron:start\"",

33 "electron:build": "npm run build:electron && electron-builder",

34 "electron:pack": "electron-builder --dir",

35 "app:bundle": "node scripts/build-app-bundle.cjs",

36 "app:bundle:open": "node scripts/build-app-bundle.cjs && open \"release/mac-arm64/Bolloon Agent.app\"",

37 "test": "vitest run",

38 "test:watch": "vitest",

39 "test:pi-sdk": "tsx src/test/pi-sdk.test.ts",

40 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 },

42 "workspaces": [

43 "src/constraint-runtime"

44 ],

45 "dependencies": {

46 "@bolloon/bolloon-agent": "^0.1.36",

47 "@bolloon/constraint-runtime": "0.1.0",

48 "@capacitor/core": "^8.4.1",

49 "@capacitor/ios": "^8.4.1",

50 "@chainsafe/libp2p-noise": "^17.0.0",

51 "@chainsafe/libp2p-yamux": "^8.0.1",

52 "@diap/sdk": "^0.1.10",

53 "@libp2p/autonat": "^3.0.20",

54 "@libp2p/circuit-relay-v2": "^4.2.5",

55 "@libp2p/dcutr": "^3.0.20",

56 "@libp2p/identify": "^4.1.6",

57 "@libp2p/kad-dht": "^16.2.6",

58 "@libp2p/tcp": "^11.0.20",

59 "@libp2p/upnp-nat": "^4.0.20",

60 "@multiformats/multiaddr": "^13.0.3",

bin/bolloon.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require("path");

3const { spawn } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1

4const fs = require

dist/heartbeat/StartupVerifier.jsView file

Lines 69-109javascript

69 }

70 // 3. 检查 LLM 配置

71 this.addCheck('llm_config');

72 this.startCheck('llm_config');

73 const hasLlmKey = !!(process.env.OPENAI_API_KEY ||

dist/security/input-scanner.jsView file

Lines 36-76javascript

36 { kind: 'pii-privatekey', re: /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY-----/g },

37 { kind: 'secret-aws', re: /AKIA[0-9A-Z]{16}/g },

38 { kind: 'secret-github',

bin/ipfsView file

•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg

bin/bolloon.cmdView file

•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg

dist/web/icons/favicon.icnsView file

•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

dist/web/server.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/web/server.jsView on unpkg