registry / @exulu/backend / 3.7.4
@exulu/backend@3.7.4
**Exulu IMP** (Intelligence Management Platform) is an open-source TypeScript framework for building production-ready AI agent applications. It provides the backend infrastructure for managing agents, semantic search contexts, background job processing, a
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a risky automatic postinstall that runs a bundled shell setup and pip, but direct inspection shows it is a package-local Python environment installer rather than an attack chain. The reviewed sources do not show exfiltration, self-dependency, stealth persistence, or foreign control-surface mutation.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm installation runs postinstall; runtime helpers run only through package APIs or commands.
Impact
It can install Python dependencies into ee/python/.venv and run configured local services; no unconsented credential theft or foreign configuration change was found.
Mechanism
Package-local virtual-environment setup and configured helper-process launching.
AI rationale
The package has a risky automatic postinstall that runs a bundled shell setup and pip, but direct inspection shows it is a package-local Python environment installer rather than an attack chain. The reviewed sources do not show exfiltration, self-dependency, stealth persistence, or foreign control-surface mutation.
Evidence
scripts/postinstall.cjsee/python/setup.shee/python/.venvee/python/requirements.txt
Network endpoints1
download.pytorch.org
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The install lifecycle automatically invokes a bundled postinstall script.
- The setup path executes a shell script that creates a package-local Python environment and installs Python dependencies.
- Runtime code can launch configured local helper processes and use configured service endpoints.
- Credential-handling code is present, so the backend has a sensitive-data processing surface.
- The flagged Python test contains a stubbed download rather than an embedded payload or live download.
Evidence against
- No source evidence of secret harvesting, fixed credential redirection, or exfiltration was found.
- No runtime dependency on this package itself was found.
- The install script targets its own ee/python/.venv directory and is skippable.
- The credential guardrail says not to store or pass credentials entered through chat.
- No foreign AI-agent configuration or broad consumer-project mutation was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/backend.cjsView file
9L10: const { spawn } = require('child_process');
L11: const { existsSync } = require('fs');
High
dist/chunk-AWMU6QXB.jsView file
5757import { promisify } from "util";
L5758: var execAsync = promisify(exec);
L5759: var REQUIRED_SYSTEM_DEPENDENCIES = [
High
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-AWMU6QXB.jsView on unpkgdist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
(req.headers["authorization"] || req.headers["x-api-key"]) ?? ""
const { baseUrl, authHeaders } = resolveLiteLLMTarget();
const endpoint = `${baseUrl}/v1/embeddings`;
// Optional attribution target for API keys (type "api"): tags requests
Some tools collect credentials (API keys, passwords, tokens) through a secure form shown directly to the user in the chat UI. Credentials are never entered in the conversation itse...
if (output && typeof output === "object" && output.oauth?.authorizationUrl) {
read them with the readFile tool. Files you produce yourself (via writeFile or via shell
this request (readFile, writeFile, bas
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg105var redisServer = {
L106: host: process.env.REDIS_HOST ?? "",
L107: port: process.env.REDIS_PORT ?? "",
...
L372: };
L373: var resolveLiteLLMConfigPath = () => process.env.LITELLM_CONFIG_PATH ?? resolve(process.cwd(), "./config.litellm.yaml");
L374: var parseEmbeddingModels = (configPath) => {
...
L530: contentType: type,
L531: metadata: {
L532: ...metadata,
...
L572: const text = this.encoder.decode(tokens);
L573: return new TextDecoder().decode(text);
L574: }
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L105105var redisServer = {
L106: host: process.env.REDIS_HOST ?? "",
L107: port: process.env.REDIS_PORT ?? "",
...
L372: };
L373: var resolveLiteLLMConfigPath = () => process.env.LITELLM_CONFIG_PATH ?? resolve(process.cwd(), "./config.litellm.yaml");
L374: var parseEmbeddingModels = (configPath) => {
...
L530: contentType: type,
L531: metadata: {
L532: ...metadata,
...
L572: const text = this.encoder.decode(tokens);
L573: return new TextDecoder().decode(text);
L574: }
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L105ee/python/setup.shView file
•path = ee/python/setup.sh
kind = build_helper
sizeBytes = 10741
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ee/python/setup.shView on unpkgee/python/transcription/tests/test_server.pyView file
•path = ee/python/transcription/tests/test_server.py
kind = payload_in_excluded_dir
sizeBytes = 3264
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
ee/python/transcription/tests/test_server.pyView on unpkgdist/chunk-27K2CO47.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @exulu/backend@3.7.3
matchedIdentity = npm:QGV4dWx1L2JhY2tlbmQ:3.7.3
similarity = 0.963
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-27K2CO47.jsView on unpkgFindings
2 Critical7 High6 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/chunk-27K2CO47.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/backend.cjs
HighShelldist/chunk-AWMU6QXB.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighPayload In Excluded Diree/python/transcription/tests/test_server.py
HighSemantic Analysis Limiteddist/chunk-AWMU6QXB.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperee/python/setup.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @exulu/backend@3.7.4.
See all versions of @exulu/backend for other recorded verdicts.
- Review the evidence and your use of @exulu/backend@3.7.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.