@exulu/backend@5.8.2
**Exulu IMP** (Intelligence Management Platform) is an open-source TypeScript framework for building production-ready AI agent applications. It provides the backend infrastructure for managing agents, semantic search contexts, background job processing, a
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe install hook performs an automatic recursive deletion in ancestor node_modules directories, potentially affecting other packages in the install tree. Although the source explains the motivation and offers an opt-out, installation does not require an explicit request for this cross-package change.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation; removal runs before the Python setup skip check.
Impact
Other packages sharing that dependency may lose node-liblzma and its xz-compression functionality.
Mechanism
The hook walks upward from the package, finds a hoisted node-liblzma directory, and recursively removes it unless EXULU_KEEP_NODE_LIBLZMA=true.
Attack narrative
During installation, the postinstall hook searches up to six ancestor directories for a hoisted node-liblzma package and recursively deletes it by default. This can alter a shared dependency used by other packages; the opt-out requires setting EXULU_KEEP_NODE_LIBLZMA=true.
AI rationale
The install hook performs an automatic recursive deletion in ancestor node_modules directories, potentially affecting other packages in the install tree. Although the source explains the motivation and offers an opt-out, installation does not require an explicit request for this cross-package change.
Evidence
package.jsonscripts/postinstall.cjsnode_modules/node-liblzma (searched in ancestor directories)ee/python/.venv
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest runs scripts/postinstall.cjs automatically during installation.
- The postinstall hook searches ancestor node_modules directories and recursively removes node-liblzma unless an environment variable is set.
- The hook calls that removal before its Python-setup skip check, so the deletion still occurs when Python setup is skipped.
Evidence against
- The postinstall script describes the removal as a targeted workaround for an optional dependency and provides an environment-variable opt-out.
- Python setup installs this package’s Python requirements; the reviewed excerpts show no install-time data collection or unrelated network destination.
- The flagged LiteLLM client sends its master key to a URL obtained from the configured LiteLLM base, consistent with its administrative API calls.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.preinstall = node -e "if (process.version !== 'v22.18.0') { console.error('❌ Wrong Node.js version. Expected v22.18.0, got ' + process.version); process.exit(1); }"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/backend.cjsView file
9L10: const { spawn } = require('child_process');
L11: const { existsSync } = require('fs');
High
bin/setup-python.cjsView file
13L14: const execAsync = promisify(exec);
L15:
High
dist/chunk-NUEM3HMI.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/chunk-NUEM3HMI.jsView on unpkg76}
L77: if (!process.env.BACKEND) {
L78: throw new Error(
...
L211: authType: row.auth_type,
L212: data: JSON.parse(decrypt(row.data))
L213: };
...
L345: var postTokenEndpoint = async (config, params) => {
L346: const response = await fetch(config.tokenUrl, {
L347: method: "POST",
...
L4974: const progress = Math.round((i + 1) / total * 100);
L4975: process.stdout.write(`Sequential processing: Document ${i + 1}/${total} (${progress}%)\r`);
L4976: }
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/chunk-NUEM3HMI.jsView on unpkg · L76dist/index.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
(req.headers["authorization"] || req.headers["x-api-key"]) ?? ""
import { mkdtemp, readFile, rm, writeFile } from "fs/promises";
await writeFile(mdPath, markdown, "utf-8");
await writeFile(docxPath, docxBytes);
var recallPublicBaseUrl = () => (process.env.BACKEND || process.env.PUBLIC_API_BASE_URL)?.replace(/\/$/, "");
var recallEnabled = () => recallRegion() !== null && !!recallApiKey() && !!recallVerificationSecret() && !!recallPublicBaseUrl();
var recallApiBaseUrl = () => {
const base = recallPublicBaseUrl();
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.jsView on unpkg233var redisServer = {
L234: host: process.env.REDIS_HOST ?? "",
L235: port: process.env.REDIS_PORT ?? "",
...
L442: // src/exulu/markdown-export.ts
L443: import { execFile } from "child_process";
L444: import { mkdtemp, readFile, rm, writeFile } from "fs/promises";
...
L1136: item_name: chunk2.item_name,
L1137: chunk_metadata: chunk2.metadata
L1138: }));
...
L1635: try {
L1636: parsed = JSON.parse(value);
L1637: } catch {
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L233ee/python/setup.shView file
•path = ee/python/setup.sh
kind = build_helper
sizeBytes = 13359
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
ee/python/setup.shView on unpkgee/python/transcription/tests/test_server.pyView file
•path = ee/python/transcription/tests/test_server.py
kind = payload_in_excluded_dir
sizeBytes = 3264
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
ee/python/transcription/tests/test_server.pyView on unpkgFindings
1 Critical7 High6 Medium7 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/backend.cjs
HighShellbin/setup-python.cjs
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/index.js
HighPayload In Excluded Diree/python/transcription/tests/test_server.py
HighSemantic Analysis Limiteddist/chunk-NUEM3HMI.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperee/python/setup.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/chunk-NUEM3HMI.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @exulu/backend@5.8.2.
See all versions of @exulu/backend for other recorded verdicts.
- Avoid installing @exulu/backend@5.8.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.