@crbonfree/cli@0.2.4
See the carbon footprint of your AI coding agents, and give them a shared memory across every tool.
AI Security Review
scanned 3d ago · by lpm-firewall-aiInstalled hooks upload prompts, replies, tool calls, and file diffs to the vendor API without a separate opt-in for content upload. The README describes session content as local unless semantic features are enabled, but the hook uploader does not check that setting.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
After a user runs crbon-hooks-install, configured agents invoke the Stop hook at session end.
Impact
Prompts, replies, tool output, and code edits leave the machine without a separate opt-in to upload that content.
Mechanism
The handler collects message content, tool calls, and file diffs, then POSTs the record to the configured server’s /api/ingest endpoint with the CRBON API key. The default host is api.crbonfree.com.
Attack narrative
After hooks are explicitly installed, session-end handlers collect prompts, replies, tool calls, and file diffs and upload them to the configured CRBON ingest endpoint. The README describes session content as local unless semantic features are enabled, but this uploader does not check that opt-in; it only applies folder-scope and redaction filters.
AI rationale
Installed hooks upload prompts, replies, tool calls, and file diffs to the vendor API without a separate opt-in for content upload. The README describes session content as local unless semantic features are enabled, but the hook uploader does not check that setting.
Evidence
dist/hooks/installerBin.jsdist/hooks/claudeHandlerBin.jsREADME.md
Network endpoints1
api.crbonfree.com/api/ingest
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The Claude transcript parser collects user and assistant message content.
- Uploaded session records include messages, tool calls, and file diffs.
- The Stop handler passes each completed session record to the uploader.
- The uploader applies folder-scope and redaction filters, then sends the record to the configured server; the default host is api.crbonfree.com.
- The uploader POSTs the payload to the server’s ingest path with the CRBON API key.
- The README says session content stays local unless semantic search and summaries are enabled.
- The installer registers a Stop hook that invokes the session handler.
Evidence against
- Hook installation requires running a separate installer command; package installation has no lifecycle script.
- The uploader supports folder exclusions and redaction before sending.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
14 flaggeddist/updateBin.jsView file
456// src/openBrowser.ts
L457: import { execFile } from "child_process";
L458: import { readFileSync as readFileSync6 } from "fs";
High
Child Process
Package source references child process execution.
dist/updateBin.jsView on unpkg · L456687const modPath = "./openclawPlugin.js";
L688: const mod = await import(modPath);
L689: if (typeof mod.installOpenClawPlugin === "function") {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/updateBin.jsView on unpkg · L687dist/mechanisms/compressCliBin.jsView file
496const result = spawnSync(command, {
L497: shell: true,
L498: encoding: "utf-8",
High
Shell
Package source references shell execution.
dist/mechanisms/compressCliBin.jsFindings
1 Critical10 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/hooks/installerBin.js
HighChild Processdist/updateBin.js
HighShelldist/mechanisms/compressCliBin.js
HighSame File Env Network Executiondist/proxyServerBin.js
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/proxyServerBin.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
HighSemantic Analysis Limiteddist/hooks/installerBin.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @crbonfree/cli@0.2.4.
See all versions of @crbonfree/cli for other recorded verdicts.
- Avoid installing @crbonfree/cli@0.2.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.