registry  /  @bolloon/bolloon-agent  /  0.2.7

@bolloon/bolloon-agent@0.2.7

P2P AI Document Agent - 全局安装后执行 `bolloon` 启动产品

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package exposes broad AI-agent capabilities at runtime, but inspected entrypoints show user-invoked launch paths and guarded tooling rather than install-time exfiltration or persistence.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install attempts missing postinstall script; runtime behavior requires user launching `bolloon` or local web/API interactions.
Impact
Install may fail due to missing postinstall file; runtime can modify allowed project files when the user or local agent workflow invokes those tools.
Mechanism
user-invoked AI agent with guarded shell/file/web/P2P capabilities
Rationale
Static inspection found noisy high-risk primitives, but they are aligned with an AI agent product and gated by explicit runtime use or local developer/user controls. The declared postinstall points to a missing file, which is a packaging defect rather than concrete malicious behavior.
Evidence
package.jsonbin/bolloon-cli.cjsdist/cli-entry.jsdist/index.jsdist/web/server.jsdist/agents/pi-sdk.jsdist/security/input-scanner.jsdist/heartbeat/StartupVerifier.jsscripts/postinstall.jsAGENTS.mdCLAUDE.md~/.bolloon/*
Network endpoints6
127.0.0.1:5001127.0.0.1:8080api.openai.com/v1api.anthropic.com/v1api.minimaxi.com/v1registry.npmjs.org

Decision evidence

public snapshot
AI called this Clean at 78.0% confidence as Benign with medium false-positive risk.
Evidence for block
  • package.json declares postinstall `node scripts/postinstall.js`, but no packaged scripts/postinstall.js exists.
  • Package includes AI-agent shell/file tools and self-improve features under dist/agents/pi-sdk.js.
  • bin/ipfs is a shipped native binary artifact.
Evidence against
  • bin/bolloon-cli.cjs and dist/cli-entry.js are CLI launchers that spawn package entrypoints only on explicit `bolloon` use.
  • dist/security/input-scanner.js Trojan-source hint is a defensive scanner regex for hidden Unicode, not hidden control flow.
  • dist/agents/pi-sdk.js write/shell tools are guarded by allowlists and path checks; self-improve is described as branch-based and user/developer-mode triggered.
  • dist/web/server.js binds to 127.0.0.1 by default and skips self-improve hook unless enabled.
  • Network calls are product-aligned local IPFS/P2P/LLM/provider endpoints, not credential exfiltration endpoints.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 254 file(s), 2.11 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.minimaxi.com, api.moonshot.cn, api.openai.com, api.xiaomi.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, esm.sh, eth.llamarpc.com, example.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn, openclaw.ai, openrouter.ai, platform.minimaxi.com, registry.npmjs.org, www.google.com, www.volcengine.com

Source & flagged code

8 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/bolloon.cjsView file
1#!/usr/bin/env node L2: const path = require("path"); L3: const { spawn } = require("child_process");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/bolloon.cjsView on unpkg · L1
dist/heartbeat/StartupVerifier.jsView file
89package = @bolloon/bolloon-agent; repositoryIdentity = bolloon; dependency = @diap/sdk L89: try { L90: await import('@diap/sdk'); L91: this.completeCheck('p2p_modules', true, '@diap/sdk available');
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/heartbeat/StartupVerifier.jsView on unpkg · L89
dist/security/input-scanner.jsView file
56contains invisible/control Unicode U+200B (zero width space) const WHITESPACE_ANOMALY_RE = /[<U+200B>-<U+200F><U+FEFF>]{5,}/g;
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/security/input-scanner.jsView on unpkg · L56
bin/ipfsView file
•path = bin/ipfs kind = native_binary sizeBytes = 77977152 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

bin/ipfsView on unpkg
bin/bolloon.cmdView file
•path = bin/bolloon.cmd kind = build_helper sizeBytes = 230 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/bolloon.cmdView on unpkg
dist/web/icons/favicon.icnsView file
•path = dist/web/icons/favicon.icns kind = high_entropy_blob sizeBytes = 467940 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/icons/favicon.icnsView on unpkg

Findings

1 Critical3 High7 Medium4 Low
CriticalTrojan Source Unicodedist/security/input-scanner.js
HighInstall Time Lifecycle Scriptspackage.json
HighCopied Package Dependency Bridgedist/heartbeat/StartupVerifier.js
HighShips High Entropy Blobdist/web/icons/favicon.icns
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/bolloon.cjs
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarybin/ipfs
MediumShips Build Helperbin/bolloon.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings