registry / @botbuddy/cli / 1.63.43
@botbuddy/cli@1.63.43
BotBuddy — Swarm coordination CLI for multi-agent workflows
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s network and persistence behavior is consistent with its CLI purpose: update checks query the npm registry, wait credentials go to the configured BotBuddy relay, and staging-pool persistence requires an explicit command. No install hook or concrete attack behavior was found.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
CLI commands; staging-pool persistence requires an explicit staging-pool install command.
Impact
Expected update-check, relay, and user-requested staging-pool behavior; no malicious impact found.
Mechanism
The CLI checks the npm registry for a version, sends wait credentials to its configured relay, and can install its staging-pool job on request.
AI rationale
The package’s network and persistence behavior is consistent with its CLI purpose: update checks query the npm registry, wait credentials go to the configured BotBuddy relay, and staging-pool persistence requires an explicit command. No install hook or concrete attack behavior was found.
Evidence
~/.botbuddy/update-check.json~/.botbuddy/staging-session-pool/<pool>/config.json~/Library/LaunchAgents/<launchd-label>.plist
Network endpoints2
registry.npmjs.org/@botbuddy/cli/latestapi.bot-buddy.ai/functions/v1/event-stream
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares CLI binaries and runtime dependencies but no install lifecycle script.
- The update check contacts the npm registry for the latest package version and reads the response version.
- Wait requests use the configured relay URL, defaulting to the BotBuddy API, and send the wait token to that relay.
- Staging-pool persistence is part of an explicitly invoked command documented for human installation.
Evidence against
- The package’s network, process, and filesystem behavior fits its CLI, relay, update, and staging-pool functions.
- No credential flow to an unrelated host or other concrete attack behavior was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/update-check.mjsView file
16import { readFileSync } from "node:fs";
L17: import { spawn, spawnSync } from "node:child_process";
L18: import { homedir } from "node:os";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L16src/staging-pool/refresh-runtime.mjsView file
26const jobPath = join(app, "job.mjs");
L27: async function owned(path, directory = false, privateFile = false) {
L28: const info = await fs.lstat(path);
...
L42: const before = await configBytes();
L43: const installed = validateInstalledConfig(JSON.parse(before));
L44: const previous = installed.poolBinding;
...
L61: const rows = await fetchRegisteredPools({
L62: exec: (file, args, callOptions) => exec(process.execPath, [file, ...args], callOptions),
L63: botbuddyBin: cliEntry, env, tenant, poolId, preserveAgentContext: true, requireTenantMatch: true,
...
L125: await fs.rename(configTemp, configPath);
L126: return { ok: true, command: "refresh-runtime", tenant, poolId, runtimeVersion: metadata.version, runtimeSha256: contentDigest, personaAliases: Object.keys(next.personas), producer:
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
Findings
5 High5 Medium3 Low
HighChild Processsrc/update-check.mjs
HighSame File Env Network Executionsrc/pw/daemon.mjs
HighTrigger Reachable Persistencesrc/staging-pool/cli.mjs
HighSemantic Analysis Limitedsrc/agent-credential-store.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/stack.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/staging-pool/refresh-runtime.mjs
MediumShips Native Binarydaemon/bin/darwin-arm64/botbuddy-daemon
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @botbuddy/cli@1.63.43.
See all versions of @botbuddy/cli for other recorded verdicts.
- Review the evidence and your use of @botbuddy/cli@1.63.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.