Loading npm security reports…

@cgh567/agent@2.4.8: Suspicious npm security report (Warn) | LPM Firewall

registry / @cgh567/agent / 2.4.8

@cgh567/agent@2.4.8

Helios agent runtime — full stack: extensions, skills, daemon, brain-v2, HEMA, governance

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface was established. The package is an AI agent platform that ships and loads many first-party skills/extensions, with install-time native dependency setup and runtime credential plumbing.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install runs postinstall; helios/helios-rpc or daemon runtime loads skills/extensions

Impact

Broad agent capabilities and local credential/environment handling create lifecycle and extension risk, but inspected code does not show unconsented foreign control-surface hijack or exfiltration.

Mechanism

first-party agent extension runtime with install-time native prebuild copy

Policy narrative

Install-time behavior copies a bundled native better-sqlite3 prebuild into the package dependency tree. Runtime wrappers load the package's declared Pi extensions/skills and may read local auth files to pass Bedrock credentials to the child agent process. This is high-trust agent platform behavior, but source inspection did not find lifecycle planting into foreign agent surfaces, hidden exfiltration, destructive actions, or persistence beyond the package-owned daemon token.

AI rationale

Source inspection supports a warn-level agent-extension lifecycle risk rather than a malicious package: the risky behavior is declared, package-aligned, and mostly runtime/user-invoked. The scanner's binary/blob and secret-looking hits are explained by native prebuilds, gitleaks rules/examples, and Bedrock login/auth handling rather than concrete attack behavior.

Evidence

package.jsonpostinstall.cjsbin/helios-rpc.jsbin/file-polyfill.cjsdaemon/helios-company-daemon.js

Decision evidence

public snapshot

AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json declares pi extensions/skills/prompts and a postinstall hook
postinstall.cjs runs at install time and copies bundled better_sqlite3.node into node_modules/better-sqlite3
bin/helios-rpc.js launches @cgh567/cli with package extension and skill directories
bin/helios-rpc.js and extensions/bedrock-login.ts read auth.json/~/.pi/agent/auth.json and inject Bedrock credentials into child process env
daemon/helios-company-daemon.js creates ~/.helios/daemon.token and mirrors data/api-token.txt at runtime

Evidence against

No postinstall writes to Claude/Codex/Cursor/MCP or other foreign agent control surfaces found
postinstall.cjs is limited to platform prebuild setup for an own dependency
Credential reads appear local runtime auth plumbing, with no exfiltration endpoint in inspected paths
extensions/lib/can-use.ts only performs capability checks for memgraph, gh, browser, imessage, erd, daemon
Network usage reviewed is package-aligned local daemon/Gmail/Slack/AWS functionality, not hidden install-time exfiltration
Bundled skills/extensions are declared by package.json pi manifest rather than hidden import-time mutation

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 1,851 file(s), 19.4 MB of source, external domains: 10.0.0.1, 127.0.0.1, 127.0.0.2, 127.255.255.255, 169.254.169.254, 172.16.0.1, 192.168.1.1, 2captcha.com, accounts.google.com, accounts.zoho.com, acme.vc, api.2captcha.com, api.anti-captcha.com, api.apollo.io, api.capsolver.com, api.github.com, api.guerrillamail.com, api.hubapi.com, api.hunter.io, api.mail.tm, api.notion.com, api.porkbun.com, api.resend.com, api.search.brave.com, api.slack.com, aws.amazon.com, calendar.google.com, cdn.jsdelivr.net, clients2.google.com, console.aws.amazon.com, console.cloud.google.com, deb.nodesource.com, docs.example.com, docs.google.com, en.wikipedia.org, example.com, external-api.com, fetched.example.com, first.com, fonts.googleapis.com, freedesktop.org, github.com, gmail.googleapis.com, graph.microsoft.com, hacker-news.firebaseio.com, helios.dev, hn.algolia.com, httpsms.com, inbox.dog, login.microsoftonline.com

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs || echo '[helios-agent] postinstall skipped'

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs || echo '[helios-agent] postinstall skipped'

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

extensions/bedrock-login.tsView file

150patternName = aws_access_key severity = critical line = 150 matchedText = placehol.....',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

extensions/bedrock-login.tsView on unpkg · L150

150patternName = aws_access_key severity = critical line = 150 matchedText = placehol.....',

Critical

Secret Pattern

AWS access key ID in extensions/bedrock-login.ts

extensions/bedrock-login.tsView on unpkg · L150

bin/helios-rpc.cjsView file

36const fs = require('fs'); L37: const { spawn } = require('child_process'); L38:

High

Child Process

Package source references child process execution.

bin/helios-rpc.cjsView on unpkg · L36

extensions/upgrade-reviewer.tsView file

746const declRegex = /export\s+(?:declare\s+)?(?:interface|type|function|class|const|let|var|enum)\s+(\w+)/g; L747: let match: RegExpExecArray | null; L748: while ((match = declRegex.exec(dtsContent)) !== null) {

High

Shell

Package source references shell execution.

extensions/upgrade-reviewer.tsView on unpkg · L746

lib/graph/erd/parse-erd.jsView file

244* that define entities/relationships as JS object literals. L245: * Backend Mapping: Pure regex — no eval(), no external deps, safe for CI. L246: * Integration Points: Merges into parseMermaidBlock → mergeResults → Memgraph pipeline.

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/graph/erd/parse-erd.jsView on unpkg · L244

bin/file-polyfill.cjsView file

5if (typeof globalThis.File === 'undefined') { L6: const { Blob } = require('buffer'); L7: globalThis.File = class File extends Blob {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/file-polyfill.cjsView on unpkg · L5

extensions/memgraph-broker-launcher.tsView file

3* L4: * Uses Node.js fork() with IPC channel for readiness signaling. L5: * The broker sends { type: 'ready' } after its socket is listening. ... L22: // HELIOS_SKIP_INFRA=1 or HELIOS_SKIP_MEMGRAPH=1: broker not started L23: if (process.env.HELIOS_SKIP_INFRA === '1' || process.env.HELIOS_SKIP_MEMGRAPH === '1') { console.warn('[WARN][memgraph-broker-launcher] HELIOS_SKIP_INFRA/MEMGRAPH=1 - skipping br... L24: // P2-11: create run dir here (not at module scope) — deferred to DATA_LAYER ... L66: const uid = typeof process.getuid === 'function' ? process.getuid() : 0; L67: return join(homedir(), '.helios', 'run', `memgraph-broker-${uid}.sock`); L68: } ... L120: // No lock file → broker not running. On POSIX also clean up stale socket. L121: if (process.platform !== 'win32') { try { unlin

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/memgraph-broker-launcher.tsView on unpkg · L3

extensions/session-reaper.tsView file

17import type { ExtensionAPI } from "@helios-agent/pi-coding-agent"; L18: import { execFile, execFileSync, spawn } from "node:child_process"; L19: import { join } from "node:path"; ... L59: fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); L60: } catch (e) { process.stderr.write(`[extensions] never crash session: ${String(e)}\n`); } L61: } ... L66: const raw = fs.readFileSync(tombstonePath, "utf-8"); L67: return JSON.parse(raw) as SessionTombstone; L68: } catch (e) { ... L83: // /proc/self/fd/0 is Linux-only; macOS uses environment variables L84: if (process.platform === 'darwin') { L85: return process.env.TERM_SESSION_ID ?? process.env.TERM_PROGRAM ?? "unknown";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

extensions/session-reaper.tsView on unpkg · L17

extensions/memgraph-autostart.tsView file

12*/ L13: import { execFile } from 'child_process'; L14: import { promisify } from 'util'; L15: import * as net from 'net'; L16: import { join } from 'path'; ... L23: const require = createRequire(import.meta.url); L24: const QUIET = process.env.PI_QUIET === '1' || process.env.PI_LOG_LEVEL === 'error'; L25:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

extensions/memgraph-autostart.tsView on unpkg · L12

12*/ L13: import { execFile } from 'child_process'; L14: import { promisify } from 'util'; L15: import * as net from 'net'; L16: import { join } from 'path'; ... L23: const require = createRequire(import.meta.url); L24: const QUIET = process.env.PI_QUIET === '1' || process.env.PI_LOG_LEVEL === 'error'; L25: ... L53: if (!driver) { L54: process.stderr.write('[memgraph-autostart] ⚠️ Driver not available yet — skipping MAGE module load (will retry on next tick)\n'); L55: return; ... L266: // AGENT_DIR: resolved from HELIOS_ROOT env var (canonical), then from helios-root.js

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

extensions/memgraph-autostart.tsView on unpkg · L12

lib/graph/web-research/auto-capture/queue.test.mjsView file

21queue.enqueue([ L22: 'https://example.com/a', L23: 'https://example.com/a', ... L114: const queue = new CaptureQueue({ drainDelayMs: 60_000 }); L115: queue.enqueue(['http://169.254.169.254/latest/meta-data/']); L116: assert.deepEqual(queue.getStats(), { queued: 0, ingested: 0, failed: 0 }); ... L124: L125: test('CaptureQueue SSRF: rejects RFC1918 private IPs', () => { L126: const queue = new CaptureQueue({ drainDelayMs: 60_000 });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/graph/web-research/auto-capture/queue.test.mjsView on unpkg · L21

lib/triage-core/types.tsView file

853contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/triage-core/types.tsView on unpkg · L853

extensions/codebase-index.tsView file

23Cross-file remote execution chain: extensions/codebase-index.ts spawns bin/helios-rpc.js; helper contains network access plus dynamic code execution. L23: import * as crypto from "node:crypto"; L24: import { execSync } from "node:child_process"; L25: ... L96: if (lockAge < LOCK_EXPIRY_MS) return false; L97: } catch (e) { process.stderr.write(`[codebase-index.ts] operation failed: ${String(e)}\n`); } L98: } ... L119: saveManifest(current); L120: if (process.env.DEBUG) { L121: process.stderr.write(`[codebase-index] skip: 0 file changes in ${repoPath}\n`); ... L196: function runLexicalFallback(query: string, limit: number, project?: string): { text: string; count: number } { L197: const searchRoot = project || findGitRoot(process.cwd()) || (require('path').join(require('os').homedir(), 'heli

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

extensions/codebase-index.tsView on unpkg · L23

extensions/helios-governance/gates/h65-confidence-gate.tsView file

503const { execSync } = require('node:child_process'); L504: const result = execSync(`npx tsc --noEmit --pretty false "${filePath}" 2>&1`, { L505: timeout: 10000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

extensions/helios-governance/gates/h65-confidence-gate.tsView on unpkg · L503

bin/fdView file

•path = bin/fd kind = native_binary sizeBytes = 2953808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/fdView on unpkg

bin/helios-rpc-wrapper.shView file

•path = bin/helios-rpc-wrapper.sh kind = build_helper sizeBytes = 789 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/helios-rpc-wrapper.shView on unpkg

skills/helios-design-system/assets/logo/web/avif/helios-logo-wordmark@4x.avifView file

•path = skills/helios-design-[redacted]-logo-wordmark@4x.avif kind = high_entropy_blob sizeBytes = 6407 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/helios-design-system/assets/logo/web/avif/helios-logo-wordmark@4x.avifView on unpkg

extensions/__tests__/session-path-fixes.test.shView file

•path = extensions/__tests__/session-path-fixes.test.sh kind = payload_in_excluded_dir sizeBytes = 4962 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

extensions/__tests__/session-path-fixes.test.shView on unpkg

extensions/lib/can-use.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cgh567/agent@2.4.7 matchedIdentity = npm:QGNnaDU2Ny9hZ2VudA:2.4.7 similarity = 0.742 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

extensions/lib/can-use.tsView on unpkg

extensions/__tests__/helpers/test-mail.tsView file

139patternName = generic_password severity = medium line = 139 matchedText = const pa...6!';

Medium

Secret Pattern

Hardcoded password in extensions/__tests__/helpers/test-mail.ts

extensions/__tests__/helpers/test-mail.tsView on unpkg · L139

extensions/helios-governance/lib/crawl4ai-client.tsView file

884patternName = generic_password severity = medium line = 884 matchedText = SETVAR p..._ME"

Medium

Secret Pattern

Hardcoded password in extensions/helios-governance/lib/crawl4ai-client.ts

extensions/helios-governance/lib/crawl4ai-client.tsView on unpkg · L884