Loading npm security reports…

@dotobokuri/fleet-console@1.100.0: Manual Review npm security | LPM Firewall

registry / @dotobokuri/fleet-console / 1.100.0

@dotobokuri/fleet-console@1.100.0

⚠ Under review

Fleet Console — sole owner of the fleet and fleet-console bins, Console web surface, and thin Claude Code launcher.

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Inspected source is a first-party Fleet Console: a gated global postinstall launcher, quota calls to Anthropic's own usage API, and bundled Mermaid UI. No install-time rewrite of other agents' config and no hidden steal-and-send sink showed up. Clean cannot be published because a clean ruling would need quotes from more files than this report is allowed to attach.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install of this package, then optional user launch of fleet or fleet-console.

Impact

no confirmed malicious impact; the review stays open only because a clean citation set cannot be completed

Mechanism

no confirmed attack chain after source inspection

AI rationale

Inspected package.json, postinstall.mjs, the fleet and CLI bundles, quota and skills plugins, and Mermaid client chunks show a local Fleet Console with product-aligned credential and eval usage, not a hidden install-time implant. A clean verdict is blocked only because this report can quote at most eight files while a clean ruling would need eleven.

Decision evidence

public snapshot

AI called this Manual Review at 78.0% confidence as Unknown with high false-positive risk.

AI review observations

A clean ruling would need quotes from 11 distinct scanner paths, but this review can attach at most 8 excerpts, so clean cannot be finalized.

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/fleet.mjsView file

8import crypto25, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs30, { mkdir as mkdir$1, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path59.join(os3.homedir(), FLEET_DATA_DIR_NAME);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

9import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L9

32301const payload = Buffer.from(JSON.stringify(input), "utf8").toString("base64url"); L32302: const bootstrap = `eval(require('node:zlib').inflateRawSync(Buffer.from(process.argv.splice(1,1)[0],'base64url')).toString('utf8'))`; L32303: const command2 = `node -e "${bootstrap}" ${CURSOR_GREP_RECEIPT_SCRIPT_BASE64} ${payload}`;

High

Eval

Package source references dynamic code evaluation.

dist/fleet.mjsView on unpkg · L32301

8import crypto25, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs30, { mkdir as mkdir$1, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path59.join(os3.homedir(), FLEET_DATA_DIR_NAME);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/fleet.mjsView on unpkg · L8

8import crypto25, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs30, { mkdir as mkdir$1, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path59.join(os3.homedir(), FLEET_DATA_DIR_NAME);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/fleet.mjsView on unpkg · L8

48}; L49: var __commonJS = (cb, mod) => function __require() { L50: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fleet.mjsView on unpkg · L48

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L22: import { promisify } from 'util'; L23: import http2 from 'http2'; L24: import { deflateRawSync, inflateRawSync } from 'zlib'; L25: import fs30, { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; ... L65: const resolved = findBinaryPath(command2, env, options); L66: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L67: } ... L94: return { L95: bin: env.ComSpec ?? "cmd.exe",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = @dotobokuri/fleet-console@1.95.0 matchedIdentity = npm:[redacted]:1.95.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs37__default, { existsSync, readFileSync, rmSync, rmdirSync, mkdirSync, writeFileSync, chmodSync, promises, lstatSync, readdirSync, constants as constants$1, realpathSync, ... import fs30, { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs37.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs37.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", mode: 384 }); const claudeCodeSyst

dist/fleet-plugins/ledger/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/ledger/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/ledger/routes.mjsView on unpkg

dist/fleet-plugins/codex/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/codex/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/codex/routes.mjsView on unpkg

dist/fleet-plugins/quota/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/quota/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/quota/routes.mjsView on unpkg

dist/fleet-plugins/skills/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/skills/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-BNdmG3jU.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/chunk-OYMX7WX6-DdYYHE30.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-BNdmG3jU.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-BKxPvWHV.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-BKxPvWHV.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-7HE2mKv2.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-7HE2mKv2.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-BKJoo8tr.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = [redacted]-NUSXRM2D-0zWurJwJ.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-BKJoo8tr.jsView on unpkg