Loading npm security reports…

@cgh567/agent@2.6.31: Suspicious npm security report (Warn) | LPM Firewall

registry / @cgh567/agent / 2.6.31

@cgh567/agent@2.6.31

Helios self-improvement lab

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This is a first-party Helios/Pi agent. On install it copies a native sqlite prebuild, and the published package registers bundled extensions and skills. At runtime those extensions can start a detached daemon, start Docker Memgraph, and globally install the Pi coding-agent package. Native binaries and the size of the tree also leave dual-use agent capability that static review cannot fully close.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install runs postinstall; running helios or a Pi session loads bundled extensions; upgrade, daemon, and Memgraph paths run from those session and CLI actions.

Impact

A consumer who installs this agent gets Helios-owned extensions, optional background daemon and graph-database startup, and a path that can change the globally installed Pi CLI.

Mechanism

first-party Pi extension registration with install-time native copy and runtime daemon, Docker, and global npm control

AI rationale

This is a first-party Helios agent that registers its own Pi extensions and can start daemons, Docker, and global npm upgrades, so it stays a warn-level agent-extension risk. Inspected install and scanner-hot files do not show a foreign-agent hijack or a nested self-install malware chain.

Evidence

package.jsonpostinstall.cjsbin/helios.jsextensions/upgrade-reviewer.tsextensions/memgraph-autostart.tsdaemon/daemon-manager.jsdaemon/lib/wizard-engine.jsprebuilds/better-sqlite3/build/Release/better_sqlite3.node

Decision evidence

public snapshot

AI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Install runs node postinstall.cjs, and the manifest registers ./extensions and ./skills as first-party Pi agent surfaces.
postinstall.cjs copies a bundled better_sqlite3.node prebuild into the better-sqlite3 release directory.
The helios CLI injects this package's extensions and skills into the packaged Pi CLI.
The upgrade-reviewer extension runs a global npm install of @helios-agent/pi-coding-agent.
memgraph-autostart starts or creates a Docker Memgraph container when a session starts.
daemon-manager spawns a detached Helios daemon, and wizard-engine bootstraps a seven-agent company.

Evidence against

postinstall does not write Claude, Cursor, or other foreign agent configs; it only prepares a sqlite native binding inside node_modules.
package.json does not depend on another release of @cgh567/agent, so the nested self-install block rule does not apply.
backfill-dashboard.js only prints an npm install hint and then spawns local tsx for a user-run backfill UI.
lib/triage-core/types.ts is ordinary triage type aliases; no bidi or invisible trojan-source characters were found.
Gmail, Slack, GitHub, and related hosts match the stated Helios inbox and coding-agent product.
Upgrade, daemon, and Memgraph actions run from Helios or Pi session and CLI paths, not from unconsented third-party agent mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 1,966 file(s), 21.3 MB of source, external domains: 127.0.0.1, 2captcha.com, accounts.google.com, accounts.zoho.com, acme.vc, api.2captcha.com, api.anti-captcha.com, api.apollo.io, api.capsolver.com, api.github.com, api.guerrillamail.com, api.hubapi.com, api.hunter.io, api.mail.tm, api.notion.com, api.porkbun.com, api.resend.com, api.search.brave.com, api.slack.com, calendar.google.com, cdn.jsdelivr.net, clients2.google.com, console.aws.amazon.com, console.cloud.google.com, console.developers.google.com, deb.nodesource.com, docs.example.com, docs.google.com, echo.epa.gov, en.wikipedia.org, example.com, external-api.com, first.com, fonts.googleapis.com, freedesktop.org, github.com, gmail.googleapis.com, graph.microsoft.com, hacker-news.firebaseio.com, helios-harada.fly.dev, helios.dev, hn.algolia.com, httpsms.com, inbox.dog, login.microsoftonline.com, mailadmin.zoho.com, mcp.mail.superhuman.com, mcp.zapier.com, memgraph.com, myaccount.google.com

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

extensions/helios-governance/lib/crawl4ai-client.tsView file

884patternName = generic_password severity = medium line = 884

Medium

Secret Pattern

Package contains a possible secret pattern.

extensions/helios-governance/lib/crawl4ai-client.tsView on unpkg · L884

bin/helios.jsView file

14const path = require('node:path'); L15: const { spawn } = require('node:child_process'); L16: const { createRequire } = require('node:module');

High

Child Process

Package source references child process execution.

bin/helios.jsView on unpkg · L14

extensions/upgrade-reviewer.tsView file

746const declRegex = /export\s+(?:declare\s+)?(?:interface|type|function|class|const|let|var|enum)\s+(\w+)/g; L747: let match: RegExpExecArray | null; L748: while ((match = declRegex.exec(dtsContent)) !== null) {

High

Shell

Package source references shell execution.

extensions/upgrade-reviewer.tsView on unpkg · L746

brainv2/task-context-strategy.tsView file

35try { L36: const { shannonEntropy } = require('../lib/graph/analytics/quantum-entropy-detector.js'); L37: // If task text itself contains error-like keywords, boost governance context

Medium

Dynamic Require

Package source references dynamic require/import behavior.

brainv2/task-context-strategy.tsView on unpkg · L35

extensions/memgraph-broker-launcher.tsView file

3* L4: * Uses Node.js fork() with IPC channel for readiness signaling. L5: * The broker sends { type: 'ready' } after its socket is listening. ... L22: // HELIOS_SKIP_INFRA=1: headless/judge mode — broker not started, resolve immediately L23: if (process.env.HELIOS_SKIP_INFRA === '1') return; L24: await new Promise<void>((resolve) => { ... L33: L34: const BROKER_SOCK = process.env.HELIOS_BROKER_SOCK || join(homedir(), 'helios-agent', 'run', 'memgraph-broker.sock'); L35: const BROKER_LOCK = BROKER_SOCK.replace('.sock', '.lock'); ... L54: try { L55: const lock = JSON.parse(readFileSync(BROKER_LOCK, 'utf8')); L56: process.kill(lock.pid, 0);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/memgraph-broker-launcher.tsView on unpkg · L3

extensions/memgraph-autostart.tsView file

12*/ L13: import { execFile } from 'child_process'; L14: import { promisify } from 'util'; L15: import * as net from 'net'; L16: import { join } from 'path'; ... L23: const require = createRequire(import.meta.url); L24: const QUIET = process.env.PI_QUIET === '1' || process.env.PI_LOG_LEVEL === 'error'; L25:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

extensions/memgraph-autostart.tsView on unpkg · L12

12*/ L13: import { execFile } from 'child_process'; L14: import { promisify } from 'util'; L15: import * as net from 'net'; L16: import { join } from 'path'; ... L23: const require = createRequire(import.meta.url); L24: const QUIET = process.env.PI_QUIET === '1' || process.env.PI_LOG_LEVEL === 'error'; L25: ... L53: if (!driver) { L54: process.stderr.write('[memgraph-autostart] ⚠️ Driver not available yet — skipping MAGE module load (will retry on next tick)\n'); L55: return; ... L266: // AGENT_DIR: resolved from HELIOS_ROOT env var (canonical), then from helios-root.js

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

extensions/memgraph-autostart.tsView on unpkg · L12

daemon/lib/wizard-engine.js#virtual:normalized:round1View file

336// ── Dispatch the CEO"s first goal-decompose task directly into Memgraph ───────\r\n//\r\n// GAP-3 FIX: The original approach used spawn() + stdin write with child.unref().\r\n// ... L337: // the 200ms setTimeout resolved before the child"s stdin was ever consumed\r\n// (helios-rpc startup + skill loading takes 2-10s). stdout/stderr pipes also\r\n// filled up (64KB O... L338: // CEO agent — exactly the same path used for all other task dispatch. No process, ... L350: // BusinessTask node — and a new duplicate "Goal Decompose" inbox card — L351: // every time the wizard"s final step re-executes for the same goal.\r\n const taskId = `task:wizard:goal-decompose:${goalId}`;\r\n\r\n const haradaPillars = [\r\n "Mind", "Sk... L352: // one, or seedToMemgraph"s per-goal MERGE below cre

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L336

backfill-dashboard.jsView file

10* - Metrics panel (right): emails, edges, episodes, deltas, memory, triage counts L11: * - Live log panel (bottom): rolling stderr/stdout stream, color-coded by severity L12: * - Header bar: status, account, elapsed time ... L27: const fs = require('fs'); L28: const { spawn } = require('child_process'); L29: ... L43: // ── Config ──────────────────────────────────────────────────────────────────── L44: const REPO = __dirname; L45: const LOG_FILE = path.join(path.dirname(REPO), 'backfill-run.log'); ... L470: const startTimestamp = new Date().toISOString().replace('T', ' ').slice(0, 19); L471: logStream.write(`\n=== Backfill dashboard started: ${startTimestamp} args: ${ARGS.join(' ')} ===\n`); L472:

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

backfill-dashboard.jsView on unpkg · L10

713} else { L714: child = spawn('npx', ['tsx', scriptPath, ...ARGS], { L715: cwd: __dirname, stdio: ['inherit', 'pipe', 'pipe'], env: { ...process.env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backfill-dashboard.jsView on unpkg · L713

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 103

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

backfill-dashboard.jsView on unpkg

lib/triage-core/types.tsView file

957contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/triage-core/types.tsView on unpkg · L957

daemon/daemon-manager.jsView file

19Cross-file remote execution chain: daemon/daemon-manager.js spawns daemon/helios-company-daemon.js; helper contains network access plus dynamic code execution. L19: const fs = require('fs'); L20: const { spawn } = require('child_process'); L21: L22: const DEFAULT_PORT = parseInt(process.env.HELIOS_DAEMON_PORT || '9093', 10); L23: const DAEMON_SCRIPT = path.join(__dirname, 'helios-company-daemon.js'); L24: // Use HELIOS_ROOT from lib/paths.js so PID_FILE is correct for all install locations ... L38: async function isHealthy(port = DEFAULT_PORT) { L39: const url = `http://localhost:${port}/api/health`; L40: try { ... L106: if (!pidAlive) { L107: // Write daemon stderr to a log file so crashes are visible for diagnosis. L108: // stdout is ignored (daemon uses log() internall

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

daemon/daemon-manager.jsView on unpkg · L19

bin/fdView file

•path = bin/fd kind = native_binary sizeBytes = 2953808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/fdView on unpkg

run-backfill.ps1View file

•path = run-backfill.ps1 kind = build_helper sizeBytes = 5006 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

run-backfill.ps1View on unpkg