@cgh567/agent@2.6.37: Suspicious npm security report (Warn)

Loading npm security reports…

@cgh567/agent@2.6.37: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The manifest runs a postinstall program automatically.
The postinstall program can execute package-local preparation targets and write a native binding into its declared dependency.
When the daemon is run, it can read configured Gmail tokens and send messages through Gmail.
A runtime module reads the local macOS Messages database and derives contact metadata from message contents.

Evidence against

The postinstall code has no network or credential-harvesting path; its packaged source-preparation targets are absent from this snapshot.
Outbound replies and forwards default to drafts unless ELYNTIC_ALLOW_SEND is set to 1.
The daemon starts only when directly executed, not when imported.
The flagged dashboard spawn launches a named local backfill script; the Trojan Source finding is a byte-order marker, not hidden control flow.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 1,753 file(s), 19.1 MB of source, external domains: 127.0.0.1, accounts.google.com, acme.vc, api.apollo.io, api.github.com, api.hubapi.com, api.hunter.io, api.notion.com, api.pipedrive.com, api.search.brave.com, api.slack.com, calendar.google.com, cdn.jsdelivr.net, console.aws.amazon.com, console.cloud.google.com, console.developers.google.com, deb.nodesource.com, docs.example.com, docs.google.com, echo.epa.gov, elyntic-harada.fly.dev, en.wikipedia.org, example.com, external-api.com, first.com, github.com, gmail.googleapis.com, graph.com, graph.microsoft.com, hacker-news.firebaseio.com, hn.algolia.com, httpsms.com, inbox.dog, login.microsoftonline.com, mcp.mail.superhuman.com, mcp.zapier.com, myaccount.google.com, new-url.com, news.ycombinator.com, oauth2.googleapis.com, other.com, porkbun.com, r.jina.ai, raw.githubusercontent.com, second.com, slack.com, test.com, third.com, twitter.com, www.apple.com

Source & flagged code

16 flagged

package.jsonView file

Lines 1-33json

2 "name": "@cgh567/agent",

3 "version": "2.6.37",

4 "packageManager": "npm@11.18.0",

5 "description": "Elyntic self-improvement lab",

6 "bin": {

7 "elyntic": "./bin/elyntic.js",

8 "elyntic-rpc": "./bin/elyntic-rpc.js",

9 "elyntic-prepare-agent-store": "./bin/prepare-agent-store.js"

10 },

11 "scripts": {

12 "build": "node scripts/build-brain-service.cjs",

13 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "patch-aliases": "node scripts/patch-pi-aliases.js",

15 "update": "node ./bin/elyntic.js update",

16 "test": "node --test tests/rpc-ready-gate.test.js tests/fixture-shape.test.js && node tests/elyntic-lab-smoke.test.js && node tests/heartbeat.test.js && node tests/integration/ingest-components.test.js && node tests/integration/apply-component-variant.test.js && node tests/integration/candidate-variant-apply.test.js && npm run test:send-gate && npm run test:backfill-diagnosis && npm run test:email-auth && npm run test:daemon-authority && npm run test:inbox-dog-refresh && node tests/backfill-accounting.test.js",

17 "test:daemon-authority": "node scripts/vitest-guarded.mjs run daemon/__tests__/package-runtime-authority.test.js daemon/__tests__/detect-signals-pipeline.test.js",

18 "test:send-gate": "node scripts/vitest-guarded.mjs run daemon/__tests__/send-gate.test.js",

19 "test:inbox-dog-refresh": "tsx --test tests/inbox-dog-credential-precedence.test.ts && tsx --test tests/inbox-dog-refresh-live.test.ts",

20 "test:clean-install": "node --test tests/clean-install-boot.test.js",

21 "test:clean-clone-publish": "node --test tests/clean-clone-publish.test.js",

22 "test:cortex-live": "node scripts/vitest-guarded.mjs run daemon/__tests__/cortex-live-rerank.live.test.js",

23 "test:pi-auth-store": "node --test tests/pi-auth-store-convergence.test.js",

24 "test:smoke": "node tests/elyntic-lab-smoke.test.js",

25 "test:hygiene": "node --test tests/retired-names-hygiene.test.js",

26 "test:guards": "node --test --test-concurrency=1 tests/pi-fork-lineage.test.js tests/node-modules-runtime-boundary.test.js tests/verify-clean-publish.test.js tests/launcher-recursion.test.js tests/signal-weight-degeneracy-guard.test.js tests/knip-policy-writer-trust.test.js && npm run test:hygiene && node scripts/guard-person-id-convergence.ts --static-only && npm run test:package-closure && npm run test:knip-boundary && npm run test:signal-contract && npm run knip && npm run knip:committed && npm run test:cortex-live && npm run test:pi-auth-store",

27 "test:signal-contract": "node scripts/vitest-guarded.mjs run lib/triage-core/__tests__/signal-assessment-store.test.ts lib/triage-core/__tests__/signal-assessment-runtime.test.ts lib/triage-core/__tests__/signal-source-evaluation-v1.test.ts daemon/__tests__/inbox-sql-reader-manifest-gate.test.js",

28 "test:knip-boundary": "node --test tests/knip-boundary.test.js tests/runtime-feature-closure.test.js tests/update-contract.test.js",

29 "knip": "node scripts/knip-check.mjs",

30 "signals:matrix": "tsx scripts/generate-signal-quality-matrix.ts",

31 "test:matrix-indexing": "node --test lib/graph/matrix/matrix-indexing.live.test.js lib/graph/matrix/serve-coding-matrix.zero-reach.live.test.js",

32 "graph:rebuild": "node scripts/ladybug-rebuild-from-sql.mjs",

33 "scale:harness": "node scripts/launch-gate/scale-harness.mjs",

bin/elyntic-ollama-models.cjsView file

Lines 3-43javascript

3 * bin/elyntic-ollama-models.cjs — live Ollama model enumeration with models.json

4 * fallback (OLLAMA-MODEL-ENUMERATION-1 / punch row L2

extensions/upgrade-reviewer.tsView file

Lines 726-766typescript

726 }

727

728 // H5 — Full cleanup of temp dir handled by finally block

729

730 } catch (e) {

731 process.stderr.write(`[upgrade-reviewer.ts] operation failed: ${String(e)}\n`);

732

brainv2/task-context-strategy.tsView file

Lines 15-51typescript

15 understand: { blastRadius: 0.1, directDeps: 0.5, history: 0.2, governance: 0.0, community: 0.2 },

16 review: { blastRadius

extensions/design-elevation/index.tsView file

Lines 1-41typescript

1// @ts-nocheck

2/**

3 * Design Elevation Extension v2.0.0

4 *

5 * Auto-detects design/UI/frontend work and injects Rams × Crawford × Pharrell

6 * three-layer methodology into agent system prompts.

7 *

8 * Review fixes: W1 (userMessage), W2 (duplicate guard), W3 (session reset)

9 */

11import

daemon/lib/wizard-engine.js#virtual:normalized:round1View file

320* L321: * Availability check uses Node"s built-in dns.resolve() — ENOTFOUND means\n * the domain has no DNS records and is likely available. This avoids making\n * HTTP requests to externa... L322: // local_date_time to value of type zoned_date_time" (500) on a live company.\n g.createdAt = datetime(), g.updatedAt = datetime()\n ON MATCH SET g.title... L323: ...result,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L320

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L320

backfill-dashboard.jsView file

10* - Metrics panel (right): emails, edges, episodes, deltas, memory, triage counts L11: * - Live log panel (bottom): rolling stderr/stdout stream, color-coded by severity L12: * - Header bar: status, account, elapsed time ... L27: const fs = require('fs'); L28: const { spawn } = require('child_process'); L29: ... L43: // ── Config ──────────────────────────────────────────────────────────────────── L44: const REPO = __dirname; L45: const LOG_FILE = path.join(path.dirname(REPO), 'backfill-run.log'); ... L470: const startTimestamp = new Date().toISOString().replace('T', ' ').slice(0, 19); L471: logStream.write(`\n=== Backfill dashboard started: ${startTimestamp} args: ${ARGS.join(' ')} ===\n`); L472:

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

backfill-dashboard.jsView on unpkg · L10

713} else { L714: child = spawn('npx', ['tsx', scriptPath, ...ARGS], { L715: cwd: __dirname, stdio: ['inherit', 'pipe', 'pipe'], env: { ...process.env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backfill-dashboard.jsView on unpkg · L713

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 93

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

backfill-dashboard.jsView on unpkg

lib/triage-core/mental-model/metadata-recompute.tsView file

2contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>// ============================================================================

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/triage-core/mental-model/metadata-recompute.tsView on unpkg · L2

daemon/daemon-manager.jsView file

19Cross-file remote execution chain: daemon/daemon-manager.js spawns daemon/elyntic-company-daemon.js; helper contains network access plus dynamic code execution. L19: const fs = require('fs'); L20: const { spawn } = require('child_process'); L21: L22: const DEFAULT_PORT = parseInt(process.env.ELYNTIC_DAEMON_PORT || '9093', 10); L23: const DAEMON_SCRIPT = path.join(__dirname, 'elyntic-company-daemon.js'); L24: // AGENT-DAEMON-INSTANCE-1: the lease this manager inspects must be the SAME file ... L41: async function isHealthy(port = DEFAULT_PORT) { L42: const url = `http://localhost:${port}/api/health`; L43: try { ... L109: if (!pidAlive) { L110: // Write daemon stderr to a log file so crashes are visible for diagnosis. L111: // stdout is ignored (daemon uses log() internally

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

daemon/daemon-manager.jsView on unpkg · L19

bin/fdView file

•path = bin/fd kind = native_binary sizeBytes = 2953808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/fdView on unpkg

run-backfill.ps1View file

•path = run-backfill.ps1 kind = build_helper sizeBytes = 2469 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

run-backfill.ps1View on unpkg

daemon/elyntic-company-daemon.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cgh567/agent@2.6.40 matchedIdentity = npm:QGNnaDU2Ny9hZ2VudA:2.6.40 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

daemon/elyntic-company-daemon.jsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/elyntic-ollama-models.cjsView file

23L24: const { spawnSync } = require('child_process'); L25:

High

Child Process

Package source references child process execution.

bin/elyntic-ollama-models.cjsView on unpkg · L23

extensions/upgrade-reviewer.tsView file

746const declRegex = /export\s+(?:declare\s+)?(?:interface|type|function|class|const|let|var|enum)\s+(\w+)/g; L747: let match: RegExpExecArray | null; L748: while ((match = declRegex.exec(dtsContent)) !== null) {

High

Shell

Package source references shell execution.

extensions/upgrade-reviewer.tsView on unpkg · L746

brainv2/task-context-strategy.tsView file

35try { L36: const { shannonEntropy } = require('../lib/graph/analytics/quantum-entropy-detector.js'); L37: // If task text itself contains error-like keywords, boost governance context

Medium

Dynamic Require

Package source references dynamic require/import behavior.

brainv2/task-context-strategy.tsView on unpkg · L35

extensions/design-elevation/index.tsView file

21L22: const HOME = homedir(); L23: const LOG_DIR = join(HOME, ".pi", "agent", "governance"); ... L97: appendFileSync(EVENTS_FILE, JSON.stringify({ ts: new Date().toISOString(), type, ...data }) + "\n"); L98: } catch (e) { process.stderr.write(`[design-elevation] never crash: ${String(e)}\n`); } L99: } ... L339: L340: // Scan package.json for framework L341: const pkgPath = join(projectPath, 'package.json'); ... L343: try { L344: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L345: const deps = { ...pkg.dependencies, ...pkg.devDependencies };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/design-elevation/index.tsView on unpkg · L21

daemon/lib/wizard-engine.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L320

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L320

backfill-dashboard.jsView file

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

backfill-dashboard.jsView on unpkg · L10

713} else { L714: child = spawn('npx', ['tsx', scriptPath, ...ARGS], { L715: cwd: __dirname, stdio: ['inherit', 'pipe', 'pipe'], env: { ...process.env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backfill-dashboard.jsView on unpkg · L713

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 93

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

backfill-dashboard.jsView on unpkg

lib/triage-core/mental-model/metadata-recompute.tsView file

2contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>// ============================================================================

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/triage-core/mental-model/metadata-recompute.tsView on unpkg · L2

daemon/daemon-manager.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

daemon/daemon-manager.jsView on unpkg · L19

bin/fdView file

•path = bin/fd kind = native_binary sizeBytes = 2953808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/fdView on unpkg

run-backfill.ps1View file

•path = run-backfill.ps1 kind = build_helper sizeBytes = 2469 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

run-backfill.ps1View on unpkg

daemon/elyntic-company-daemon.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

daemon/elyntic-company-daemon.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 1-33json

2 "name": "@cgh567/agent",

3 "version": "2.6.37",

4 "packageManager": "npm@11.18.0",

5 "description": "Elyntic self-improvement lab",

6 "bin": {

7 "elyntic": "./bin/elyntic.js",

8 "elyntic-rpc": "./bin/elyntic-rpc.js",

9 "elyntic-prepare-agent-store": "./bin/prepare-agent-store.js"

10 },

11 "scripts": {

12 "build": "node scripts/build-brain-service.cjs",

13 "postinstall": "node postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "patch-aliases": "node scripts/patch-pi-aliases.js",

15 "update": "node ./bin/elyntic.js update",

17 "test:daemon-authority": "node scripts/vitest-guarded.mjs run daemon/__tests__/package-runtime-authority.test.js daemon/__tests__/detect-signals-pipeline.test.js",

18 "test:send-gate": "node scripts/vitest-guarded.mjs run daemon/__tests__/send-gate.test.js",

19 "test:inbox-dog-refresh": "tsx --test tests/inbox-dog-credential-precedence.test.ts && tsx --test tests/inbox-dog-refresh-live.test.ts",

20 "test:clean-install": "node --test tests/clean-install-boot.test.js",

21 "test:clean-clone-publish": "node --test tests/clean-clone-publish.test.js",

22 "test:cortex-live": "node scripts/vitest-guarded.mjs run daemon/__tests__/cortex-live-rerank.live.test.js",

23 "test:pi-auth-store": "node --test tests/pi-auth-store-convergence.test.js",

24 "test:smoke": "node tests/elyntic-lab-smoke.test.js",

25 "test:hygiene": "node --test tests/retired-names-hygiene.test.js",

28 "test:knip-boundary": "node --test tests/knip-boundary.test.js tests/runtime-feature-closure.test.js tests/update-contract.test.js",

29 "knip": "node scripts/knip-check.mjs",

30 "signals:matrix": "tsx scripts/generate-signal-quality-matrix.ts",

31 "test:matrix-indexing": "node --test lib/graph/matrix/matrix-indexing.live.test.js lib/graph/matrix/serve-coding-matrix.zero-reach.live.test.js",

32 "graph:rebuild": "node scripts/ladybug-rebuild-from-sql.mjs",

33 "scale:harness": "node scripts/launch-gate/scale-harness.mjs",

bin/elyntic-ollama-models.cjsView file

Lines 3-43javascript

3 * bin/elyntic-ollama-models.cjs — live Ollama model enumeration with models.json

4 * fallback (OLLAMA-MODEL-ENUMERATION-1 / punch row L2

extensions/upgrade-reviewer.tsView file

Lines 726-766typescript

726 }

727

728 // H5 — Full cleanup of temp dir handled by finally block

729

730 } catch (e) {

731 process.stderr.write(`[upgrade-reviewer.ts] operation failed: ${String(e)}\n`);

732

brainv2/task-context-strategy.tsView file

Lines 15-51typescript

15 understand: { blastRadius: 0.1, directDeps: 0.5, history: 0.2, governance: 0.0, community: 0.2 },

16 review: { blastRadius

extensions/design-elevation/index.tsView file

Lines 1-41typescript

1// @ts-nocheck

2/**

3 * Design Elevation Extension v2.0.0

4 *

5 * Auto-detects design/UI/frontend work and injects Rams × Crawford × Pharrell

6 * three-layer methodology into agent system prompts.

7 *

8 * Review fixes: W1 (userMessage), W2 (duplicate guard), W3 (session reset)

9 */

11import

daemon/lib/wizard-engine.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L320

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

daemon/lib/wizard-engine.js#virtual:normalized:round1View on unpkg · L320

backfill-dashboard.jsView file

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

backfill-dashboard.jsView on unpkg · L10

713} else { L714: child = spawn('npx', ['tsx', scriptPath, ...ARGS], { L715: cwd: __dirname, stdio: ['inherit', 'pipe', 'pipe'], env: { ...process.env }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

backfill-dashboard.jsView on unpkg · L713

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 93

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

backfill-dashboard.jsView on unpkg

lib/triage-core/mental-model/metadata-recompute.tsView file

2contains invisible/control Unicode U+FEFF (zero width no-break space) <U+FEFF>// ============================================================================

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

lib/triage-core/mental-model/metadata-recompute.tsView on unpkg · L2

daemon/daemon-manager.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

daemon/daemon-manager.jsView on unpkg · L19

bin/fdView file

•path = bin/fd kind = native_binary sizeBytes = 2953808 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/fdView on unpkg

run-backfill.ps1View file

•path = run-backfill.ps1 kind = build_helper sizeBytes = 2469 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

run-backfill.ps1View on unpkg

daemon/elyntic-company-daemon.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

daemon/elyntic-company-daemon.jsView on unpkg

@cgh567/agent@2.6.37

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code