Loading npm security reports…

@dotobokuri/fleet-console@1.103.0: Suspicious npm security report | LPM Firewall

registry / @dotobokuri/fleet-console / 1.103.0

@dotobokuri/fleet-console@1.103.0

Fleet Console — sole owner of the fleet and fleet-console bins, Console web surface, and thin Claude Code launcher.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No attack surface was identified. The install hook starts this package's own local console only on an opted-in global install, and the shipped client bundles are diagram renderers.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall on a non-CI global install, unless FLEET_CONSOLE_NO_AUTO_START or FLEET_CONSOLE_NO_AUTO_OPEN is set.

Impact

A local product server may start after a global install. No foreign agent control-surface write, credential export, or remote payload was found.

Mechanism

The hook may chmod a node-pty helper and spawn dist/cli.mjs, whose default mode ensures a loopback Fleet Console daemon and prints its URL.

AI rationale

The postinstall behavior is limited to a node-pty permission fix and an optional start of this package's own console CLI. Inspected entrypoints and client bundles show product console and Mermaid rendering code, not a hidden install attack.

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

package.json names bins fleet and fleet-console, points main at dist/cli.mjs, and sets postinstall to node postinstall.mjs with no self-dependency.

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/fleet.mjsView file

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L13: import { promisify, styleText } from 'node:util'; L14: import http2 from 'node:http2'; L15: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L16: import V2, { stdin, stdout } from 'node:process'; L17: import http from 'node:http'; ... L62: )); L63: function getFleetDataDir(env = process.env) { L64: const override = env[FLEET_DATA_DIR_ENV]; L65: if (override === void 0 || override.trim().length === 0) return path64.join(os4.homedir(), FLEET_DATA_DIR_NAME);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

59405function verifyMacWindowIdentity(target2) { L59406: return new Promise((resolve4) => { L59407: execFile("/usr/bin/osascript", ["-l", "JavaScript", "-e", WINDOW_IDENTITY, "verify", String(target2.pid), String(target2.windowId), String(target2.processStartedAt)], { timeout: 3e... L59408: }); ... L59413: if (error51) { L59414: process.stderr.write(`[fleet-computer-use] window identity unavailable: ${/window_accessibility_-25211/.test(error51.message) ? "accessibility_permission_required" : "window_lookup... L59415: `);

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/fleet.mjsView on unpkg · L59405

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L8

29814const payload = Buffer.from(JSON.stringify(input), "utf8").toString("base64url"); L29815: const bootstrap = `eval(require('node:zlib').inflateRawSync(Buffer.from(process.argv.splice(1,1)[0],'base64url')).toString('utf8'))`; L29816: const command2 = `node -e "${bootstrap}" ${CURSOR_GREP_RECEIPT_SCRIPT_BASE64} ${payload}`;

High

Eval

Package source references dynamic code evaluation.

dist/fleet.mjsView on unpkg · L29814

52459} L52460: async function validateAgentCliPathForSave(executablePath, env = process.env, runVersion = execFileVersion) { L52461: const resolution = validateUserAgentCliPath(executablePath, env); ... L52468: function execFileVersion(bin, args) { L52469: return new Promise((resolve4, reject) => { L52470: execFile( L52471: bin,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/fleet.mjsView on unpkg · L52459

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L13: import { promisify, styleText } from 'node:util'; L14: import http2 from 'node:http2'; L15: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L16: import V2, { stdin, stdout } from 'node:process'; L17: import http from 'node:http'; ... L62: )); L63: function getFleetDataDir(env = process.env) { L64: const override = env[FLEET_DATA_DIR_ENV]; L65: if (override === void 0 || override.trim().length === 0) return path64.join(os4.homedir(), FLEET_DATA_DIR_NAME);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/fleet.mjsView on unpkg · L8

39}; L40: var __commonJS = (cb, mod) => function __require() { L41: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fleet.mjsView on unpkg · L39

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L13: import os3__default, { tmpdir, homedir } from 'node:os'; L14: import net from 'node:net'; L15: import tls from 'node:tls'; ... L20: import http2 from 'node:http2'; L21: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L22: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L56: const resolved = findBinaryPath(command2, env, options); L57: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L58: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = @dotobokuri/fleet-console@1.101.0 matchedIdentity = npm:[redacted]:1.101.0 similarity = 0.899 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs40__default, { constants, existsSync, readFileSync, rmSync, rmdirSync, mkdirSync, writeFileSync, chmodSync, promises, lstatSync, readdirSync, realpathSync, mkdtempSync, re... import fs11, { mkdir, readdir, readFile, rm, writeFile, open, appendFile, chmod, mkdtemp, rename, stat, unlink } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs40.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs40.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", m

dist/fleet-plugins/skills/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/skills/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-DPlxmttt.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/chunk-OYMX7WX6-DdYYHE30.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-DPlxmttt.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-CFcYAjE9.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-CFcYAjE9.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-I6b7xQAn.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-I6b7xQAn.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-C3DNfInj.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = [redacted]-NUSXRM2D-0zWurJwJ.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-C3DNfInj.jsView on unpkg

Source & flagged code

20 flagged

package.jsonView file

Lines 25-65json

25 },

26 "./desktop-protocol": {

27 "types": "./dist/desktop-protocol.d.ts",

28 "default": "./dist/desktop-protocol.mjs"

29 },

30 "./cli": {

31 "types": "./dist/cli.d.ts",

32 "default": "./dist/cli.mjs"

33 }

34 },

35 "files": [

36 "dist",

37 "postinstall.mjs",

38 "CLAUDE.md",

39 "README.md"

40 ],

41 "engines": {

42 "node": ">=20.19.0"

43 },

44 "scripts": {

45 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "node-pty": "^1.0.0",

49 "ws": "^8.18.0",

50 "font-list": "^2.1.0",

51 "@anthropic-ai/claude-agent-sdk": "^0.3.269",

52 "@vscode/ripgrep": "1.18.0",

53 "selfsigned": "^5.5.0",

54 "esbuild": "0.27.7",

55 "@modelcontextprotocol/sdk": "1.30.0",

56 "tar": "7.5.22",

57 "fflate": "0.8.2"

58 },

59 "devDependencies": {

60 "@fontsource-variable/cascadia-code": "^5.2.2",

61 "@fontsource-variable/fira-code": "^5.2.7",

62 "@fontsource-variable/fraunces": "^5.2.9",

63 "@fontsource-variable/jetbrains-mono": "^5.2.8",

64 "@fontsource-variable/manrope": "^5.2.8",

65 "@fontsource-variable/source-code-pro": "^5.2.7",

dist/fleet.mjsView file

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L13: import { promisify, styleText } from 'node:util'; L14: import http2 from 'node:http2'; L15: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L16: import V2, { stdin, stdout } from 'node:process'; L17: import http from 'node:http'; ... L62: )); L63: function getFleetDataDir(env = process.env) { L64: const override = env[FLEET_DATA_DIR_ENV]; L65: if (override === void 0 || override.trim().length === 0) return path64.join(os4.homedir(), FLEET_DATA_DIR_NAME);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

59405function verifyMacWindowIdentity(target2) { L59406: return new Promise((resolve4) => { L59407: execFile("/usr/bin/osascript", ["-l", "JavaScript", "-e", WINDOW_IDENTITY, "verify", String(target2.pid), String(target2.windowId), String(target2.processStartedAt)], { timeout: 3e... L59408: }); ... L59413: if (error51) { L59414: process.stderr.write(`[fleet-computer-use] window identity unavailable: ${/window_accessibility_-25211/.test(error51.message) ? "accessibility_permission_required" : "window_lookup... L59415: `);

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/fleet.mjsView on unpkg · L59405

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L13: import os3__default, { tmpdir, homedir } from 'node:os'; L14: import net from 'node:net'; L15: import tls from 'node:tls'; ... L20: import http2 from 'node:http2'; L21: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L22: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L56: const resolved = findBinaryPath(command2, env, options); L57: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L58: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = @dotobokuri/fleet-console@1.101.0 matchedIdentity = npm:[redacted]:1.101.0 similarity = 0.899 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs40__default, { constants, existsSync, readFileSync, rmSync, rmdirSync, mkdirSync, writeFileSync, chmodSync, promises, lstatSync, readdirSync, realpathSync, mkdtempSync, re... import fs11, { mkdir, readdir, readFile, rm, writeFile, open, appendFile, chmod, mkdtemp, rename, stat, unlink } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs40.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs40.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", m

dist/fleet-plugins/skills/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/skills/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-DPlxmttt.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/chunk-OYMX7WX6-DdYYHE30.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-DPlxmttt.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-CFcYAjE9.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-CFcYAjE9.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-I6b7xQAn.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-I6b7xQAn.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-C3DNfInj.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = [redacted]-NUSXRM2D-0zWurJwJ.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-C3DNfInj.jsView on unpkg