registry / @dotobokuri/fleet-console / 1.202.2

@dotobokuri/fleet-console@1.202.2

Fleet Console — sole owner of the fleet and fleet-console bins, Console web surface, and thin Claude Code launcher.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A global npm installation can automatically launch the console, which includes a credential-aware local AI gateway. Its Codex plugin can create workspace-local agent instruction files during workspace initialization.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global non-CI installation without the opt-out variables, followed by console or plugin workspace use.

Impact

This is a guarded first-party agent-extension and credential-forwarding capability. No confirmed external credential exfiltration or active malicious attack was established.

Mechanism

The lifecycle hook launches the CLI; the CLI reads Claude credentials for credential-gated gateway proxy routes, and the plugin writes a default AGENTS.md under its knowledge workspace.

AI rationale

The source establishes a real guarded agent-extension lifecycle risk and automatic install-time launch. It does not establish an unrelated credential recipient, broad foreign control-surface mutation, or another concrete malicious chain.

Evidence

package.jsonpostinstall.mjsdist/cli.mjsdist/fleet-plugins/codex/routes.mjs

Network endpoints3

/api/hello/v1/models/v1/messages

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package declares a postinstall lifecycle hook.
During qualifying global installs, the hook starts the bundled CLI automatically.
The CLI can read Claude Code credentials from the macOS keychain.
The local gateway exposes credential-gated proxy routes.
The Codex plugin creates an AGENTS.md file in its workspace knowledge root.

Evidence against

The automatic start is limited to global, non-CI installs and has opt-out environment variables.
The exposed gateway health route is loopback-gated; no unrelated external credential recipient was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 69 file(s), 16.3 MB of source, external domains: 127.0.0.1, aider.chat, api.anthropic.com, api.github.com, api.meta.ai, api.openai.com, api.typesafe.ai, api.x.ai, arcprize.org, artificialanalysis.ai, auth.x.ai, bigcode-bench.github.io, chatgpt.com, chevrotain.io, claude-staging.fedstart.com, claude.fedstart.com, cli-chat-proxy.grok.com, cloudcode-pa.googleapis.com, creativecommons.org, crfm-helm.readthedocs.io, cursor.com, daily-cloudcode-pa.googleapis.com, en.wikipedia.org, epoch.ai, evalplus.github.io, fleet.invalid, github.com, gorilla.cs.berkeley.edu, help.arena.ai, huggingface.co, img.shields.io, json-schema.org, labs.scale.com, langium.org, livebench.ai, livecodebench.github.io, livecodebenchpro.com, llm-stats.com, metr.org, models.dev, opencode.ai, openrouter.ai, rank.opencompass.org.cn, raw.githubusercontent.com, react.dev, reactrouter.com, registry.npmjs.org, scicode-bench.github.io, skills.sh, swe-bench-live.github.io

Source & flagged code

14 flagged

package.jsonView file

Lines 25-65json

25 },

26 "./desktop-protocol": {

27 "types": "./dist/desktop-protocol.d.ts",

28 "default": "./dist/desktop-protocol.mjs"

29 },

30 "./cli": {

31 "types": "./dist/cli.d.ts",

32 "default": "./dist/cli.mjs"

33 }

34 },

35 "files": [

36 "dist",

37 "postinstall.mjs",

38 "CLAUDE.md",

39 "README.md"

40 ],

41 "engines": {

42 "node": ">=20.19.0"

43 },

44 "scripts": {

45 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 },

47 "dependencies": {

48 "node-pty": "^1.0.0",

49 "ws": "^8.18.0",

50 "font-list": "^2.1.0",

51 "@anthropic-ai/claude-agent-sdk": "^0.3.269",

52 "@vscode/ripgrep": "1.18.0",

53 "selfsigned": "^5.5.0",

54 "esbuild": "0.27.7",

55 "@modelcontextprotocol/sdk": "1.30.0",

56 "tar": "7.5.22",

57 "fflate": "0.8.2"

58 },

59 "devDependencies": {

60 "@fontsource-variable/cascadia-code": "^5.2.2",

61 "@fontsource-variable/fira-code": "^5.2.7",

62 "@fontsource-variable/fraunces": "^5.2.9",

63 "@fontsource-variable/jetbrains-mono": "^5.2.8",

64 "@fontsource-variable/manrope": "^5.2.8",

65 "@fontsource-variable/source-code-pro": "^5.2.7",

dist/fleet.mjsView file

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url'; ... L14: import { promisify, styleText } from 'node:util'; L15: import process8, { stdin, stdout } from 'node:process'; L16: import http from 'node:http'; L17: import { strToU8, zipSync, unzipSync } from 'fflate'; L18: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L61: )); L62: function getFleetDataDir(env = process.env) { L63: const override = env[FLEET_DATA_DIR_ENV]; L64: if (override === void 0 || override.trim().length === 0) return path67.join(os4.homedir(), FLEET_DATA_DIR_NAME);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L8

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L13: import os3__default, { tmpdir, homedir } from 'node:os'; L14: import net from 'node:net'; L15: import tls from 'node:tls'; ... L20: import { promisify } from 'node:util'; L21: import { strToU8, zipSync, unzipSync } from 'fflate'; L22: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L55: const resolved = findBinaryPath(command2, env, options); L56: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L57: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs47__default, { constants, existsSync, readFileSync, rmSync, rmdirSync, mkdirSync, writeFileSync, chmodSync, readdirSync, promises, lstatSync, realpathSync, accessSync, mkd... import fs26__default, { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs47.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs47.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", mode: 384 }); const claud

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-CGICONTR.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/chunk-OYMX7WX6-DdYYHE30.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-CGICONTR.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-BowaiFj_.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-BowaiFj_.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-D2pkhSqn.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-D2pkhSqn.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-BXN3osLI.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = [redacted]-NUSXRM2D-0zWurJwJ.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-BXN3osLI.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/fleet.mjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

8import { createRequire, builtinModules } from 'node:module'; L9: import { execFile, spawn, execFileSync } from 'node:child_process'; L10: import { fileURLToPath, pathToFileURL } from 'node:url';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L8

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/fleet.mjsView on unpkg · L8

38}; L39: var __commonJS = (cb, mod) => function __require() { L40: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/fleet.mjsView on unpkg · L38

dist/cli.mjsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

6Cross-file remote execution chain: dist/cli.mjs spawns dist/fleet-plugins/codex/routes.mjs; helper contains network access plus dynamic code execution. L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L13: import os3__default, { tmpdir, homedir } from 'node:os'; L14: import net from 'node:net'; L15: import tls from 'node:tls'; ... L20: import { promisify } from 'node:util'; L21: import { strToU8, zipSync, unzipSync } from 'fflate'; L22: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L55: const resolved = findBinaryPath(command2, env, options); L56: return resolved ? wrapWindowsShim(

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L6

6Trigger-reachable credential exfiltration chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L13: import os3__default, { tmpdir, homedir } from 'node:os'; L14: import net from 'node:net'; L15: import tls from 'node:tls'; ... L20: import { promisify } from 'node:util'; L21: import { strToU8, zipSync, unzipSync } from 'fflate'; L22: import { tool, createSdkMcpServer, query, getSessionInfo } from '@anthropic-ai/claude-agent-sdk'; ... L55: const resolved = findBinaryPath(command2, env, options); L56: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L57: }

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.mjsView on unpkg · L6

dist/client/assets/chunk-OYMX7WX6-CGICONTR.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-CGICONTR.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-BowaiFj_.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-BowaiFj_.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-D2pkhSqn.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-D2pkhSqn.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-BXN3osLI.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-BXN3osLI.jsView on unpkg

Findings

2 Critical10 High5 Medium7 Low

CriticalCredential Exfiltrationdist/fleet.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/fleet.mjs

HighCredential Redirect Persistencedist/cli.mjs

HighCommand Output Exfiltrationdist/fleet.mjs

HighCross File Remote Execution Contextdist/cli.mjs

HighTrigger Reachable Credential Exfiltrationdist/cli.mjs

HighKnown Malware Source Similaritydist/client/assets/chunk-OYMX7WX6-CGICONTR.js

HighKnown Malware Source Similaritydist/client/assets/diagram-G4DWMVQ6-BowaiFj_.js

HighKnown Malware Source Similaritydist/client/assets/flowDiagram-DWJPFMVM-D2pkhSqn.js

HighKnown Malware Source Similaritydist/client/assets/wardleyDiagram-NUSXRM2D-BXN3osLI.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/fleet.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to @dotobokuri/fleet-console@1.202.2.

See version security history for other recorded verdicts.

Review the evidence and your use of @dotobokuri/fleet-console@1.202.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-29 07:28:51.145Z (UTC).