@dotobokuri/fleet-console@1.107.0: Suspicious npm security report

Loading npm security reports…

@dotobokuri/fleet-console@1.107.0: Suspicious npm security report | LPM Firewall

AI called this Suspicious at 80.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json defines a postinstall lifecycle hook and CLI entrypoints.
The postinstall hook automatically runs the CLI for non-CI global installs unless an opt-out environment variable is set.
The CLI can start a Codex app server with computer-use, plugins, and MCP-elicitation features enabled in a temporary CODEX_HOME.
The broker only accepts a narrowly shaped computer-use elicitation request before asking its approval callback.
Codex credentials are sent only to chatgpt.com usage endpoints in the inspected usage path.

Evidence against

No evidence was found that the postinstall hook writes a broad or foreign AI-agent configuration.
The inspected Codex broker uses a temporary directory and removes OpenAI-related environment variables before spawning the child process.
No unrelated credential recipient or covert network destination was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 68 file(s), 15.7 MB of source, external domains: 127.0.0.1, aider.chat, api.anthropic.com, api.github.com, api.kimi.com, api.openai.com, api.typesafe.ai, api.x.ai, api2.cursor.sh, arcprize.org, artificialanalysis.ai, auth.x.ai, bigcode-bench.github.io, chatgpt.com, chevrotain.io, cli-chat-proxy.grok.com, cloudcode-pa.googleapis.com, creativecommons.org, crfm-helm.readthedocs.io, cursor.com, daily-cloudcode-pa.googleapis.com, en.wikipedia.org, epoch.ai, evalplus.github.io, fleet.invalid, github.com, gorilla.cs.berkeley.edu, help.arena.ai, huggingface.co, img.shields.io, json-schema.org, labs.scale.com, langium.org, livebench.ai, livecodebench.github.io, livecodebenchpro.com, llm-stats.com, metr.org, models.dev, opencode.ai, openrouter.ai, rank.opencompass.org.cn, raw.githubusercontent.com, react.dev, reactrouter.com, registry.npmjs.org, scicode-bench.github.io, skills.sh, swe-bench-live.github.io, swe-rebench.com

Source & flagged code

20 flagged

package.jsonView file

Lines 25-65json

25 },

26 "./desktop-protocol": {

27 "types": "./dist/desktop-protocol.d.ts",

28 "default": "./dist/desktop-protocol.mjs"

29 },

30 "./cli": {

31 "types": "./dist/cli.d.ts",

32 "default": "./dist/cli.mjs"

33 }

34 },

35 "files": [

36 "dist",

37 "postinstall.mjs",

38 "CLAUDE.md",

39 "README.md"

40 ],

41 "engines": {

42 "node": ">=20.19.0"

43 },

44 "scripts": {

45 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "node-pty": "^1.0.0",

49 "ws": "^8.18.0",

50 "font-list": "^2.1.0",

51 "@anthropic-ai/claude-agent-sdk": "^0.3.269",

52 "@vscode/ripgrep": "1.18.0",

53 "selfsigned": "^5.5.0",

54 "esbuild": "0.27.7",

55 "@modelcontextprotocol/sdk": "1.30.0",

56 "tar": "7.5.22",

57 "fflate": "0.8.2"

58 },

59 "devDependencies": {

60 "@fontsource-variable/cascadia-code": "^5.2.2",

61 "@fontsource-variable/fira-code": "^5.2.7",

62 "@fontsource-variable/fraunces": "^5.2.9",

63 "@fontsource-variable/jetbrains-mono": "^5.2.8",

64 "@fontsource-variable/manrope": "^5.2.8",

65 "@fontsource-variable/source-code-pro": "^5.2.7",

dist/fleet.mjsView file

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L13: import { promisify, styleText } from 'node:util'; L14: import http2 from 'node:http2'; L15: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L16: import V2, { stdin, stdout } from 'node:process'; L17: import http from 'node:http'; ... L62: )); L63: function getFleetDataDir(env = process.env) { L64: const override = env[FLEET_DATA_DIR_ENV]; L65: if (override === void 0 || override.trim().length === 0) return path66.join(os4.homedir(), FLEET_DATA_DIR_NAME);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

60695function verifyMacWindowIdentity(target2) { L60696: return new Promise((resolve4) => { L60697: execFile("/usr/bin/osascript", ["-l", "JavaScript", "-e", WINDOW_IDENTITY, "verify", String(target2.pid), String(target2.windowId), String(target2.processStartedAt)], { timeout: 3e... L60698: }); ... L60703: if (error51) { L60704: process.stderr.write(`[fleet-computer-use] window identity unavailable: ${/window_accessibility_-25211/.test(error51.message) ? "accessibility_permission_required" : "window_lookup... L60705: `);

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/fleet.mjsView on unpkg · L60695

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L13: import os3__default, { tmpdir, homedir } from 'node:os'; L14: import net from 'node:net'; L15: import tls from 'node:tls'; ... L20: import http2 from 'node:http2'; L21: import { deflateRawSync, inflateRawSync } from 'node:zlib'; L22: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L56: const resolved = findBinaryPath(command2, env, options); L57: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L58: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs41__default, { constants, existsSync, readFileSync, rmSync, rmdirSync, mkdirSync, writeFileSync, chmodSync, promises, lstatSync, readdirSync, realpathSync, mkdtempSync, re... import fs12, { mkdir, readdir, readFile, rm, writeFile, open, appendFile, chmod, mkdtemp, rename, stat, unlink } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs41.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs41.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", m

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/fleet-plugins/skills/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/skills/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-ovQU2Lw3.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/chunk-OYMX7WX6-DdYYHE30.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-ovQU2Lw3.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-DLLPDwwD.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-DLLPDwwD.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-DZYQPL4P.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-DZYQPL4P.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-CWhYEJAQ.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = [redacted]-NUSXRM2D-0zWurJwJ.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-CWhYEJAQ.jsView on unpkg

dist/fleet-plugins/codex/routes.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dotobokuri/fleet-console@1.105.0 matchedIdentity = npm:[redacted]:1.105.0 similarity = 0.986 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/fleet-plugins/codex/routes.mjsView on unpkg

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/fleet.mjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/fleet.mjsView on unpkg · L60695

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L8

30684const payload = Buffer.from(JSON.stringify(input), "utf8").toString("base64url"); L30685: const bootstrap = `eval(require('node:zlib').inflateRawSync(Buffer.from(process.argv.splice(1,1)[0],'base64url')).toString('utf8'))`; L30686: const command2 = `node -e "${bootstrap}" ${CURSOR_GREP_RECEIPT_SCRIPT_BASE64} ${payload}`;

High

Eval

Package source references dynamic code evaluation.

dist/fleet.mjsView on unpkg · L30684

53537} L53538: async function validateAgentCliPathForSave(executablePath, env = process.env, runVersion = execFileVersion) { L53539: const resolution = validateUserAgentCliPath(executablePath, env); ... L53546: function execFileVersion(bin, args) { L53547: return new Promise((resolve4, reject) => { L53548: execFile( L53549: bin,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/fleet.mjsView on unpkg · L53537

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/fleet.mjsView on unpkg · L8

39}; L40: var __commonJS = (cb, mod) => function __require() { L41: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fleet.mjsView on unpkg · L39

dist/cli.mjsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/fleet-plugins/skills/routes.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-ovQU2Lw3.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-ovQU2Lw3.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-DLLPDwwD.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-DLLPDwwD.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-DZYQPL4P.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-DZYQPL4P.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-CWhYEJAQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-CWhYEJAQ.jsView on unpkg

dist/fleet-plugins/codex/routes.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/fleet-plugins/codex/routes.mjsView on unpkg

Source & flagged code

20 flagged

package.jsonView file

Lines 25-65json

25 },

26 "./desktop-protocol": {

27 "types": "./dist/desktop-protocol.d.ts",

28 "default": "./dist/desktop-protocol.mjs"

29 },

30 "./cli": {

31 "types": "./dist/cli.d.ts",

32 "default": "./dist/cli.mjs"

33 }

34 },

35 "files": [

36 "dist",

37 "postinstall.mjs",

38 "CLAUDE.md",

39 "README.md"

40 ],

41 "engines": {

42 "node": ">=20.19.0"

43 },

44 "scripts": {

45 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "node-pty": "^1.0.0",

49 "ws": "^8.18.0",

50 "font-list": "^2.1.0",

51 "@anthropic-ai/claude-agent-sdk": "^0.3.269",

52 "@vscode/ripgrep": "1.18.0",

53 "selfsigned": "^5.5.0",

54 "esbuild": "0.27.7",

55 "@modelcontextprotocol/sdk": "1.30.0",

56 "tar": "7.5.22",

57 "fflate": "0.8.2"

58 },

59 "devDependencies": {

60 "@fontsource-variable/cascadia-code": "^5.2.2",

61 "@fontsource-variable/fira-code": "^5.2.7",

62 "@fontsource-variable/fraunces": "^5.2.9",

63 "@fontsource-variable/jetbrains-mono": "^5.2.8",

64 "@fontsource-variable/manrope": "^5.2.8",

65 "@fontsource-variable/source-code-pro": "^5.2.7",

dist/fleet.mjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/fleet.mjsView on unpkg · L60695

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

dist/cli.mjsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/fleet-plugins/skills/routes.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-ovQU2Lw3.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-ovQU2Lw3.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-DLLPDwwD.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-DLLPDwwD.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-DZYQPL4P.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-DZYQPL4P.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-CWhYEJAQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-CWhYEJAQ.jsView on unpkg

dist/fleet-plugins/codex/routes.mjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/fleet-plugins/codex/routes.mjsView on unpkg

@dotobokuri/fleet-console@1.107.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code