@exulu/backend@5.2.0
**Exulu IMP** (Intelligence Management Platform) is an open-source TypeScript framework for building production-ready AI agent applications. It provides the backend infrastructure for managing agents, semantic search contexts, background job processing, a
AI Security Review
scanned 20d ago · by lpm-firewall-aiThe automatic dependency removal can affect a consumer's shared node_modules tree, so it presents unresolved destructive risk and warrants a warning. The agent skill setup is user-invoked, and the inspected source does not establish credential theft or another block-level attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installing the package triggers the dependency removal; a user request followed by an install or update command triggers the skill placement.
Impact
Removing a consumer-owned or otherwise shared dependency could break software that relies on it. Installed skills can change the instructions available to the selected agents, though the reviewed flow documents user-requested operations.
Mechanism
The hook searches upward from the package for the first matching node-liblzma directory and removes it. Separately, a bundled helper distributes skills from the configured backend to selected agent clients.
AI rationale
The automatic dependency removal can affect a consumer's shared node_modules tree, so it presents unresolved destructive risk and warrants a warning. The agent skill setup is user-invoked, and the inspected source does not establish credential theft or another block-level attack.
Evidence
scripts/postinstall.cjsdist/index.jsdist/index.cjsnode_modules/node-liblzma.agents/skills.claude/skills.windsurf/skills.continue/skills.roo/skills
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest runs scripts/postinstall.cjs automatically after installation.
- The postinstall hook calls the removal routine before checking whether Python setup should be skipped.
- The removal routine searches up to six ancestor directories for node_modules/node-liblzma.
- When found, it recursively deletes that directory; an environment variable can opt out.
- The bundle also contains a first-party skill installer that can write skills into agent client directories through documented install or update commands.
- The bootstrap endpoint packages that helper, and its instructions use a configured backend and direct it to act on user requests.
Evidence against
- The dependency removal targets one named package and has an opt-out, which is consistent with package-specific cleanup, though the search can reach the consumer's hoisted dependency tree.
- The skill installer is documented for user-requested operations and uses configured settings; the example host appears in instructions, not as a fixed network destination. No credential redirection to that host was identified.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/backend.cjsView file
9L10: const { spawn } = require('child_process');
L11: const { existsSync } = require('fs');
High
bin/setup-python.cjsView file
13L14: const execAsync = promisify(exec);
L15:
High
dist/chunk-ASF74XFZ.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-ASF74XFZ.jsView on unpkg43// src/exulu/litellm/supervisor.ts
L44: import { spawn } from "child_process";
L45: import { existsSync } from "fs";
...
L62: };
L63: var isLiteLLMEnabled = () => process.env.EXULU_USE_LITELLM === "true";
L64: var resolveConfig = (packageRoot) => {
...
L67: const masterKey = process.env.LITELLM_MASTER_KEY;
L68: const configPath = process.env.LITELLM_CONFIG_PATH ?? resolve(process.cwd(), "./config.litellm.yaml");
L69: const venvBin = resolve(packageRoot, "ee/python/.venv/bin");
...
L75: var pollHealth = async (host, port) => {
L76: const url = `http://${host}:${port}/health/liveliness`;
L77: const deadline = Date.now() + READY_TIMEOUT_MS;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/chunk-ASF74XFZ.jsView on unpkg · L43dist/index.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @exulu/backend@5.1.2
matchedIdentity = npm:QGV4dWx1L2JhY2tlbmQ:5.1.2
similarity = 0.791
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkg•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
(req.headers["authorization"] || req.headers["x-api-key"]) ?? ""
import { mkdtemp, readFile, rm, writeFile } from "fs/promises";
await writeFile(mdPath, markdown, "utf-8");
await writeFile(docxPath, docxBytes);
var recallPublicBaseUrl = () => (process.env.BACKEND || process.env.PUBLIC_API_BASE_URL)?.replace(/\/$/, "");
var recallEnabled = () => recallRegion() !== null && !!recallApiKey() && !!recallVerificationSecret() && !!recallPublicBaseUrl();
var recallApiBaseUrl = () => {
const base = recallPublicBaseUrl();
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg210var redisServer = {
L211: host: process.env.REDIS_HOST ?? "",
L212: port: process.env.REDIS_PORT ?? "",
...
L419: // src/exulu/markdown-export.ts
L420: import { execFile } from "child_process";
L421: import { mkdtemp, readFile, rm, writeFile } from "fs/promises";
...
L895: const teams = rbacRecords.filter((r) => r.access_type === "Team")?.map((r) => ({ id: r.team_id, rights: r.rights }));
L896: let type = rights_mode || "private";
L897: if (type === "users" && users.length === 0) type = "private";
...
L1226: item_name: chunk2.item_name,
L1227: chunk_metadata: chunk2.metadata
L1228: }));
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L210ee/python/setup.shView file
•path = ee/python/setup.sh
kind = build_helper
sizeBytes = 13359
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ee/python/setup.shView on unpkgee/python/transcription/tests/test_server.pyView file
•path = ee/python/transcription/tests/test_server.py
kind = payload_in_excluded_dir
sizeBytes = 3264
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
ee/python/transcription/tests/test_server.pyView on unpkgFindings
2 Critical7 High6 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/backend.cjs
HighShellbin/setup-python.cjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighPayload In Excluded Diree/python/transcription/tests/test_server.py
HighSemantic Analysis Limiteddist/chunk-ASF74XFZ.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperee/python/setup.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/chunk-ASF74XFZ.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @exulu/backend@5.2.0.
See all versions of @exulu/backend for other recorded verdicts.
- Review the evidence and your use of @exulu/backend@5.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.