Loading npm security reports…

@dotobokuri/fleet-console@1.90.0: Malicious npm security report | LPM Firewall

registry / @dotobokuri/fleet-console / 1.90.0

@dotobokuri/fleet-console@1.90.0

Fleet Console — sole owner of the fleet and fleet-console bins, Console web surface, and thin Claude Code launcher.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

An installation lifecycle can automatically launch the package CLI on global installs. Its gateway reads a local Grok token, forwards it to a fixed proxy, and changes Claude Code gateway cache data.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Global npm installation in an interactive environment, followed by the launched gateway runtime.

Impact

A local authentication token and model requests can be redirected to the package-selected proxy while Claude Code is pointed at the package gateway.

Mechanism

Automatic CLI launch, credential forwarding, and AI-agent gateway configuration.

Attack narrative

The package installs a postinstall hook that can launch its CLI without a separate user command during a global install. The CLI obtains a Grok access token from the user's local authentication file and posts it as a Bearer credential to a fixed proxy endpoint. It also prepares Claude Code launches with a package-selected gateway URL and persists the gateway model cache in the user's Claude configuration directory. This combines automatic install-time activation, credential redirection, and AI-agent control-surface changes.

AI rationale

Source inspection confirms a lifecycle-triggered CLI launch and a runtime path that forwards a local credential to a fixed proxy while modifying Claude Code gateway configuration. These behaviors create a concrete credential-redirection and agent-control risk.

Evidence

package.jsonpostinstall.mjsdist/cli.mjs~/.grok/auth.json~/.claude/cache/gateway-models.json

Network endpoints

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest runs postinstall, and the installer automatically starts the CLI during eligible global installs.
The CLI reads the local Grok authentication file and sends its bearer token to a fixed proxy endpoint.
The CLI configures Claude Code to use its gateway and writes a gateway model cache under the Claude configuration directory.

Evidence against

The postinstall launcher skips CI, opt-out, ordinary dependency installs, and headless Linux environments.
The credential-bearing request is reachable through the package's gateway runtime rather than unconditionally during every installation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 65 file(s), 7.73 MB of source, external domains: 127.0.0.1, aider.chat, api.anthropic.com, api.kimi.com, api2.cursor.sh, arcprize.org, artificialanalysis.ai, auth.x.ai, bigcode-bench.github.io, chatgpt.com, chevrotain.io, cli-chat-proxy.grok.com, cloudcode-pa.googleapis.com, creativecommons.org, crfm-helm.readthedocs.io, cursor.com, daily-cloudcode-pa.googleapis.com, en.wikipedia.org, epoch.ai, evalplus.github.io, github.com, gorilla.cs.berkeley.edu, help.arena.ai, huggingface.co, json-schema.org, labs.scale.com, langium.org, livebench.ai, livecodebench.github.io, livecodebenchpro.com, llm-stats.com, metr.org, models.dev, opencode.ai, openrouter.ai, rank.opencompass.org.cn, react.dev, registry.npmjs.org, scicode-bench.github.io, skills.sh, swe-bench-live.github.io, swe-rebench.com, swefficiency.com, taubench.com, www.kimi.com, www.swebench.com, www.vals.ai, www.w3.org

Oversized source lightweight scan

dist/cli.mjs2.28 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStrings127.0.0.1

dist/client/assets/index-W-PcgCOT.js2.60 MB file, sampled 256 KB

NetworkHighEntropyStringsMinifiedUrlStringsreact.dev

dist/fleet.mjs2.88 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStrings127.0.0.1registry.npmjs.org

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/fleet.mjsView file

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L67: )); L68: function getFleetDataDir(env = process.env) { L69: const override = env[FLEET_DATA_DIR_ENV]; L70: if (override === void 0 || override.trim().length === 0) return path24.join(os3.homedi

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

9import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L9

126return { L127: bin: env.ComSpec ?? "cmd.exe", L128: prefixArgs: ["/d", "/s", "/c", "call", forceWindowsArgQuoting(resolved)]

High

Shell

Package source references shell execution.

dist/fleet.mjsView on unpkg · L126

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L67: )); L68: function getFleetDataDir(env = process.env) { L69: const override = env[FLEET_DATA_DIR_ENV]; L70: if (override === void 0 || override.trim().length === 0) return path24.join(os3.homedi

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/fleet.mjsView on unpkg · L8

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L67: )); L68: function getFleetDataDir(env = process.env) { L69: const override = env[FLEET_DATA_DIR_ENV]; L70: if (override === void 0 || override.trim().length === 0) return path24.join(os3.homedi

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/fleet.mjsView on unpkg · L8

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile as execFile$1, spawn, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L22: import { promisify } from 'util'; L23: import http2 from 'http2'; L24: import { deflateRawSync, inflateRawSync } from 'zlib'; L25: import { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; ... L61: const resolved = findBinaryPath(command2, env, options); L62: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L63: } ... L90: return { L91: bin: env.ComSpec ?? "cmd.exe",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•matchType = previous_version_dangerous_delta matchedPackage = @dotobokuri/fleet-console@1.89.0 matchedIdentity = npm:[redacted]:1.89.0 similarity = 0.899 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs17__default, { existsSync, readFileSync, realpathSync, accessSync, constants as constants$1, lstatSync, rmSync, mkdirSync, mkdtempSync, writeFileSync, promises, chmodSync,... import { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs17.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs17.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", mode: 384 }); const claudeCodeSystemProm

dist/client/assets/chunk-OYMX7WX6-DdYYHE30.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.1.6 matchedPath = dist/public/assets/chunk-DI55MBZ5-dxkg4zyd.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-DdYYHE30.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.jsView file

•matchType = token_shingles matchedPackage = termdock@1.4.200 matchedPath = dist/client/assets/diagram-VX7I27RA-BO1XNjDC.js matchedIdentity = npm:dGVybWRvY2s:1.4.200 similarity = 0.875 shingleOverlap = 42 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.jsView on unpkg