Loading npm security reports…

@co0ontty/wand@4.56.0: Malicious npm security report (Block) | LPM Firewall

registry / @co0ontty/wand / 4.56.0

@co0ontty/wand@4.56.0

A web console for Claude Code, Codex, OpenCode, and other local CLI tools.

AI Security Review

scanned 29d ago · by lpm-firewall-ai

The bundled browser extension can capture login credentials on any website and send them to its configured service. Its initial configuration selects an external host.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user installs the bundled extension, signs in, and accepts its prompt to save a submitted login.

Impact

Website usernames and passwords can be disclosed to the operator of the default service.

Mechanism

Browser-wide credential capture followed by authenticated upload to an external default service.

Attack narrative

The package includes a browser extension that is active on all websites. Its content script extracts submitted login credentials and, after its own save prompt, passes them to the background worker. The worker uploads them through the configured API. The extension is preconfigured to use home.huniu.fun instead of the local service described by the npm package, creating a concrete route for credential collection by an unrelated external host.

AI rationale

This package bundles a browser-wide credential collector configured to transmit saved credentials to an external endpoint, despite being advertised as a local AI CLI web console. The lack of an npm install hook does not remove this runtime credential-exfiltration path.

Evidence

browser-extension/manifest.jsonbrowser-extension/shared/url-tools.mjsbrowser-extension/src/content-script.jsbrowser-extension/src/background.jsbrowser-extension/src/api.js

Network endpoints

Source & flagged code

25 flagged

dist/config.jsView file

80patternName = generic_password severity = medium line = 80

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L80

dist/taskboard-bridge.jsView file

3import { createServer } from "node:net"; L4: import { spawn } from "node:child_process"; L5: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/taskboard-bridge.jsView on unpkg · L3

210await mkdir(dataDir, { recursive: true }); L211: const child = spawn(process.execPath, [path.join(vendorRoot, "server/index.mjs")], { L212: cwd: vendorRoot, L213: env: { L214: ...process.env, L215: CODEX_TASKBOARD_HOST: "127.0.0.1", ... L222: const handler = async (req, res) => { L223: const incoming = new URL(req.originalUrl, "http://127.0.0.1"); L224: const pathname = incoming.pathname.replace(/^\/taskboard/, "") || "/";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/taskboard-bridge.jsView on unpkg · L210

dist/git-utils.jsView file

34} L35: function gitExecAsyncOptions(cwd, opts) { L36: return {

High

Shell

Package source references shell execution.

dist/git-utils.jsView on unpkg · L34

dist/tui/layout.jsView file

2import { stripAnsi } from "../pty-text-utils.js"; L3: const require = createRequire(import.meta.url); L4: // neo-blessed 是 CJS，没有匹配 @types/blessed 的 default export，统一当 any 用。

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tui/layout.jsView on unpkg · L2

dist/password-manager.jsView file

1import crypto from "node:crypto"; L2: export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183"; L3: export const DEFAULT_PASSWORD_VAULT_ID = "personal"; ... L255: const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]); L256: return `${VAULT_CIPHER_PREFIX}${iv.toString("base64url")}.${cipher.getAuthTag().toString("base64url")}.${encrypted.toString("base64url")}`; L257: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/password-manager.jsView on unpkg · L1

dist/tui/commands.jsView file

4Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/tui/commands.js L4: * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L39: stdio: "inherit", L40: env: process.env, L41: }); ... L107: export function openInBrowser(url) { L108: const cmd = process.platform === "darwin" L109: ? "open" ... L133: ok: false,

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/tui/commands.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/commands.jsView on unpkg

4* 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L39: stdio: "inherit", L40: env: process.env, L41: }); ... L107: export function openInBrowser(url) { L108: const cmd = process.platform === "darwin" L109: ? "open" ... L133: ok: false,

browser-extension/src/background.jsView file

•A browser extension granted access to all pages captures login passwords and POSTs vault records to a package-defined external default service. browser-extension/manifest.json: "<all_urls>" "service_worker": "src/background.js", "content_scripts": [ "<all_urls>" browser-extension/shared/url-tools.mjs: export const DEFAULT_BASE_URL = "https://home.huniu.fun:8183"; if (!raw) return DEFAULT_BASE_URL; if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return DEFAULT_BASE_URL; return DEFAULT_BASE_URL; const parsed = new URL(raw.includes("://") ? raw : `https://${raw}`); browser-extension/src/background.js: return { login: await loginAndAttach(message.baseUrl, message.password) }; body: JSON.stringify(message.item) body: JSON.stringify(message.item) body: JSON.stringify({ secret: m

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

13Cross-file remote execution chain: dist/npm[redacted] spawns dist/web-ui/content/scripts.js; helper contains network access plus dynamic code execution. L13: */ L14: import { execFile, spawnSync } from "node:child_process"; L15: import { randomUUID } from "node:crypto"; ... L26: const PACKAGE_BASENAME = "wand"; L27: const DEFAULT_NPM_BIN = process.platform === "win32" ? "npm.cmd" : "npm"; L28: const COMMON_UNIX_PATHS = ["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"]; ... L32: function npmBin() { L33: return process.env.WAND_NPM_BIN || DEFAULT_NPM_BIN; L34: } ... L78: try { L79: const { stdout } = await execFileAsync(npmBin(), ["view", getInstallSpecForChannel(channel), "version"], { timeout: timeoutMs, env: getChildEnv(), maxBuffer: INSTALL_MAX_BUFFER }); L8

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/npm-update-utils.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/npm[redacted] matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/server.jsView file

5Detached bundled service listener: dist/server.js launches a Node helper and exposes a broad-bound HTTP listener. L5: import { stat } from "node:fs/promises"; L6: import { createServer as createHttpServer } from "node:http"; L7: import { createServer as createHttpsServer } from "node:https"; L8: import { spawn } from "node:child_process"; L9: import os from "node:os"; ... L60: // ── Package info ── L61: const PKG_JSON = JSON.parse(readFileSync(path.join(RUNTIME_ROOT_DIR, "package.json"), "utf8")); L62: const PKG_NAME = PKG_JSON.name; ... L104: function isExternalAvatarSource(value) { L105: return /^(https?:|data:)/i.test(value); L106: } ... L376: const candidates = [];

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server.jsView on unpkg · L5

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/terminal-daemon-server.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/terminal-daemon-server.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-daemon-server.jsView on unpkg

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/cli.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/path-repair.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/path-repair.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/provider-cli-updater.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/terminal-daemon-client.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/terminal-daemon-client.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-daemon-client.jsView on unpkg

dist/update-helper.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/update-helper.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/git-quick-commit.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/git-quick-commit.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-quick-commit.jsView on unpkg

dist/server-file-routes.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/server-file-routes.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server-file-routes.jsView on unpkg

dist/cert.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/cert.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/distribution-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.55.1 matchedPath = dist/distribution-manager.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.55.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/distribution-manager.jsView on unpkg

Source & flagged code

25 flagged · loading source

dist/config.jsView file

80patternName = generic_password severity = medium line = 80

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L80

dist/taskboard-bridge.jsView file

3import { createServer } from "node:net"; L4: import { spawn } from "node:child_process"; L5: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/taskboard-bridge.jsView on unpkg · L3

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/taskboard-bridge.jsView on unpkg · L210

dist/git-utils.jsView file

34} L35: function gitExecAsyncOptions(cwd, opts) { L36: return {

High

Shell

Package source references shell execution.

dist/git-utils.jsView on unpkg · L34

dist/tui/layout.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tui/layout.jsView on unpkg · L2

dist/password-manager.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/password-manager.jsView on unpkg · L1

dist/tui/commands.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/commands.jsView on unpkg

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/npm-update-utils.jsView on unpkg · L13

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/server.jsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server.jsView on unpkg · L5

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/terminal-daemon-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-daemon-server.jsView on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/path-repair.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/terminal-daemon-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-daemon-client.jsView on unpkg

dist/update-helper.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/git-quick-commit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-quick-commit.jsView on unpkg

dist/server-file-routes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server-file-routes.jsView on unpkg

dist/cert.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/distribution-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/distribution-manager.jsView on unpkg

Source & flagged code

25 flagged

dist/config.jsView file

80patternName = generic_password severity = medium line = 80

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L80

dist/taskboard-bridge.jsView file

3import { createServer } from "node:net"; L4: import { spawn } from "node:child_process"; L5: import path from "node:path";

High

Child Process

Package source references child process execution.

dist/taskboard-bridge.jsView on unpkg · L3

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/taskboard-bridge.jsView on unpkg · L210

dist/git-utils.jsView file

34} L35: function gitExecAsyncOptions(cwd, opts) { L36: return {

High

Shell

Package source references shell execution.

dist/git-utils.jsView on unpkg · L34

dist/tui/layout.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tui/layout.jsView on unpkg · L2

dist/password-manager.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/password-manager.jsView on unpkg · L1

dist/tui/commands.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/tui/commands.jsView on unpkg

browser-extension/src/background.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

browser-extension/src/background.jsView on unpkg

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

browser-extension/src/background.js

dist/npm-update-utils.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/npm-update-utils.jsView on unpkg · L13

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/server.jsView file

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server.jsView on unpkg · L5

dist/cert.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cert.js#virtual:normalized:round1View on unpkg

dist/terminal-daemon-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-daemon-server.jsView on unpkg

dist/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

dist/path-repair.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/terminal-daemon-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/terminal-daemon-client.jsView on unpkg

dist/update-helper.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/git-quick-commit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-quick-commit.jsView on unpkg

dist/server-file-routes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/server-file-routes.jsView on unpkg

dist/cert.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cert.jsView on unpkg

dist/distribution-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/distribution-manager.jsView on unpkg

@co0ontty/wand@4.56.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code