registry / @exulu/backend / 2.3.0
@exulu/backend@2.3.0
**Exulu IMP** (Intelligence Management Platform) is an open-source TypeScript framework for building production-ready AI agent applications. It provides the backend infrastructure for managing agents, semantic search contexts, background job processing, a
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource establishes an explicit, first-party AI-agent extension setup capability, so a warning is appropriate. It does not establish malicious or unconsented install-time behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An operator downloads the bootstrap skill and explicitly runs its `imp install` or `imp update` command.
Impact
Can modify managed AI-agent skill directories in the selected project or home scope; no install-time agent mutation was found.
Mechanism
Explicit authenticated multi-client AI-agent skill installation
AI rationale
Source establishes an explicit, first-party AI-agent extension setup capability, so a warning is appropriate. It does not establish malicious or unconsented install-time behavior.
Evidence
package.jsonscripts/postinstall.cjsee/python/setup.shdist/index.cjsdist/cli/start-whisper.cjsee/python/transcription/tests/__init__.py.agents/skills/<name>.claude/skills/<name>
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `dist/index.cjs` embeds an IMP skill installer and serves it from `/skills/agent/bootstrap`.
- Decoded installer downloads skills and writes/copies/symlinks them into `.agents/skills` and configured agent-client skill directories.
- `scripts/postinstall.cjs` runs `ee/python/setup.sh`, which creates a package-local venv and installs listed Python dependencies.
Evidence against
- `package.json` lifecycle hooks do not invoke the agent-skill bootstrap; `postinstall` only invokes Python setup.
- The embedded agent installer is documented for explicit `install`/`update` commands and skips unmanaged destination directories.
- `ee/python/transcription/tests/__init__.py` is empty; no unexpected binary payload was found.
- No bidi/invisible control characters were found in reviewed executable sources.
- `dist/cli/start-whisper.cjs` starts a local Whisper service, defaulting to `127.0.0.1`.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
18123patternName = private_key_rsa
severity = critical
line = 18123
matchedText = "private...--",
Critical
Critical Secret
Package contains a critical-looking secret pattern.
dist/index.jsView on unpkg · L1812311245contains invisible/control Unicode U+FEFF (zero width no-break space)
const match = /^<U+FEFF>?---\r?\n([\s\S]*?)\r?\n---/.exec(md);
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/index.jsView on unpkg · L11245•Trigger-reachable chain: manifest.main -> dist/index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg18123patternName = private_key_rsa
severity = critical
line = 18123
matchedText = "private...--",
Critical
92var redisServer = {
L93: host: process.env.REDIS_HOST ?? "",
L94: port: process.env.REDIS_PORT ?? "",
...
L353: };
L354: var resolveLiteLLMConfigPath = () => process.env.LITELLM_CONFIG_PATH ?? resolve(process.cwd(), "./config.litellm.yaml");
L355: var parseEmbeddingModels = (configPath) => {
...
L511: contentType: type,
L512: metadata: {
L513: ...metadata,
...
L557: const text = this.encoder.decode(tokens);
L558: return new TextDecoder().decode(text);
L559: }
Low
ee/python/setup.shView file
•path = ee/python/setup.sh
kind = build_helper
sizeBytes = 10741
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ee/python/setup.shView on unpkgee/python/transcription/tests/__init__.pyView file
•path = ee/python/transcription/tests/__init__.py
kind = payload_in_excluded_dir
sizeBytes = 0
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
ee/python/transcription/tests/__init__.pyView on unpkgdist/cli/start-whisper.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @exulu/backend@1.70.0
matchedIdentity = npm:QGV4dWx1L2JhY2tlbmQ:1.70.0
similarity = 0.444
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/start-whisper.cjsView on unpkgdist/index.cjsView file
26042patternName = private_key_rsa
severity = critical
line = 26042
matchedText = "private...--",
Critical
Findings
7 Critical2 High6 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalCritical Secretdist/index.js
CriticalTrojan Source Unicodedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/cli/start-whisper.cjs
CriticalSecret Patterndist/index.js
CriticalSecret Patterndist/index.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Diree/python/transcription/tests/__init__.py
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperee/python/setup.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @exulu/backend@2.3.0.
See all versions of @exulu/backend for other recorded verdicts.
- Review the evidence and your use of @exulu/backend@2.3.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.