registry / @exulu/backend / 5.8.0
@exulu/backend@5.8.0
**Exulu IMP** (Intelligence Management Platform) is an open-source TypeScript framework for building production-ready AI agent applications. It provides the backend infrastructure for managing agents, semantic search contexts, background job processing, a
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe install hook runs the package’s Python setup, while the flagged credential flow requires client mode and an operator-supplied LITELLM_BASE_URL. The reviewed paths show no fixed unofficial gateway or unrelated data collection.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Installation runs postinstall setup; runtime network requests occur when backend features such as transcription or LiteLLM administration are invoked.
Impact
No unsolicited collection or fixed foreign credential destination was identified; configured inference requests carry their expected credentials and inputs.
Mechanism
The install hook sets up the package’s Python environment. LiteLLM client requests use an operator-configured base URL, with localhost as the default target.
AI rationale
The install hook runs the package’s Python setup, while the flagged credential flow requires client mode and an operator-supplied LITELLM_BASE_URL. The reviewed paths show no fixed unofficial gateway or unrelated data collection.
Evidence
ee/python/.venvnode_modules/node-liblzma
Network endpoints3
download.pytorch.org/whl/cu124127.0.0.1:4000LITELLM_BASE_URL (operator configured)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest’s postinstall hook runs scripts/postinstall.cjs, which invokes the package’s ee/python/setup.sh.
- The Python setup installs Whisper dependencies; its CUDA option uses the official download.pytorch.org wheel host.
- EXULU_API_KEY is forwarded only in LiteLLM client mode when the operator sets LITELLM_BASE_URL; otherwise the target defaults to localhost.
- Transcription requests send audio and the configured target’s auth headers to that target when the transcription function is called.
Evidence against
- Installation runs a shell setup script automatically and removes a hoisted optional node-liblzma dependency.
- A configured remote LiteLLM endpoint receives EXULU_API_KEY as an authentication header.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/backend.cjsView file
9L10: const { spawn } = require('child_process');
L11: const { existsSync } = require('fs');
High
bin/setup-python.cjsView file
13L14: const execAsync = promisify(exec);
L15:
High
dist/chunk-NUEM3HMI.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-NUEM3HMI.jsView on unpkg76}
L77: if (!process.env.BACKEND) {
L78: throw new Error(
...
L211: authType: row.auth_type,
L212: data: JSON.parse(decrypt(row.data))
L213: };
...
L345: var postTokenEndpoint = async (config, params) => {
L346: const response = await fetch(config.tokenUrl, {
L347: method: "POST",
...
L4974: const progress = Math.round((i + 1) / total * 100);
L4975: process.stdout.write(`Sequential processing: Document ${i + 1}/${total} (${progress}%)\r`);
L4976: }
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/chunk-NUEM3HMI.jsView on unpkg · L76dist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
(req.headers["authorization"] || req.headers["x-api-key"]) ?? ""
import { mkdtemp, readFile, rm, writeFile } from "fs/promises";
await writeFile(mdPath, markdown, "utf-8");
await writeFile(docxPath, docxBytes);
var recallPublicBaseUrl = () => (process.env.BACKEND || process.env.PUBLIC_API_BASE_URL)?.replace(/\/$/, "");
var recallEnabled = () => recallRegion() !== null && !!recallApiKey() && !!recallVerificationSecret() && !!recallPublicBaseUrl();
var recallApiBaseUrl = () => {
const base = recallPublicBaseUrl();
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg233var redisServer = {
L234: host: process.env.REDIS_HOST ?? "",
L235: port: process.env.REDIS_PORT ?? "",
...
L442: // src/exulu/markdown-export.ts
L443: import { execFile } from "child_process";
L444: import { mkdtemp, readFile, rm, writeFile } from "fs/promises";
...
L1136: item_name: chunk2.item_name,
L1137: chunk_metadata: chunk2.metadata
L1138: }));
...
L1635: try {
L1636: parsed = JSON.parse(value);
L1637: } catch {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L233ee/python/setup.shView file
•path = ee/python/setup.sh
kind = build_helper
sizeBytes = 13359
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ee/python/setup.shView on unpkgee/python/transcription/tests/test_server.pyView file
•path = ee/python/transcription/tests/test_server.py
kind = payload_in_excluded_dir
sizeBytes = 3264
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
ee/python/transcription/tests/test_server.pyView on unpkgdist/chunk-4W3V7IHR.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @exulu/backend@5.7.2
matchedIdentity = npm:QGV4dWx1L2JhY2tlbmQ:5.7.2
similarity = 0.954
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/chunk-4W3V7IHR.jsView on unpkgFindings
2 Critical7 High6 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/chunk-4W3V7IHR.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/backend.cjs
HighShellbin/setup-python.cjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighPayload In Excluded Diree/python/transcription/tests/test_server.py
HighSemantic Analysis Limiteddist/chunk-NUEM3HMI.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperee/python/setup.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/chunk-NUEM3HMI.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @exulu/backend@5.8.0.
See all versions of @exulu/backend for other recorded verdicts.
- Review the evidence and your use of @exulu/backend@5.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.