Loading npm security reports…

@geravant/sinain: AI-agent control-surface risk | LPM Firewall

registry / @geravant/sinain / 1.41.1

@geravant/sinain@1.41.1

Context OS — ambient intelligence for builders. Captures screen + audio, distills into a private knowledge graph, accessible from MCP, web UI, and HUD overlay.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall detects an existing OpenClaw installation and mutates its global configuration. It enables this extension, broadens session-tool visibility, and binds the gateway to the LAN without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when ~/.openclaw/openclaw.json exists

Impact

Enables a package-controlled agent extension, grants broad session tool visibility, exposes the gateway on LAN, and can execute a newer registry package.

Mechanism

automatic OpenClaw control-surface mutation and remote self-update execution

Policy narrative

Installing the package runs its postinstall hook. If OpenClaw is present, it automatically imports the installer, writes and enables the sinain-hud extension in OpenClaw configuration, sets global session tool visibility to all, and changes the gateway bind mode to LAN. Before dispatch, the CLI may fetch the latest npm version and execute it through npx.

Rationale

This is an unconsented postinstall mutation of a broad AI-agent control surface, not merely a package-local setup. The guarded detection does not obtain consent, and the same path also enables registry-driven replacement execution.

Evidence

package.jsoncli.jsinstall.jsself-update.js~/.openclaw/extensions/sinain-hud~/.openclaw/sinain-sources~/.openclaw/openclaw.json~/.openclaw/workspace

Network endpoints

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli.js install --if-openclaw

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli.js install --if-openclaw

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

sinain-core/src/capture/voice-session.tsView file

1import { spawn, type ChildProcess } from "node:child_process"; L2: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

sinain-core/src/capture/voice-session.tsView on unpkg · L1

setup-embedding.jsView file

113// to guarantee the same module instance (and cache key) as the runtime. L114: const require = createRequire(path.join(CORE_DIR, "package.json")); L115: // Use dynamic import with the resolved path — createRequire gives us the path

Medium

Dynamic Require

Package source references dynamic require/import behavior.

setup-embedding.jsView on unpkg · L113

sinain-core/src/capture/window-ops.tsView file

26function maxWindowChars(): number { L27: const v = parseInt(process.env.SINAIN_BURST_MAX_CHARS || "", 10); L28: return Number.isFinite(v) && v > 0 ? v : DEFAULT_MAX_WINDOW_CHARS;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

sinain-core/src/capture/window-ops.tsView on unpkg · L26

sinain-core/src/mcp-tunnel/controller.tsView file

122const entry = resolve(this.deps.packageRoot, "sinain-mcp-server", "index.ts"); L123: this.mcpHttp = spawn(tsxBin, [entry], { L124: env: { L125: ...process.env, L126: MCP_TRANSPORT: "http", L127: MCP_HTTP_PORT: String(MCP_HTTP_PORT), L128: SINAIN_CORE_URL: process.env.SINAIN_CORE_URL || `http://localhost:${this.deps.corePort}`, L129: SINAIN_WORKSPACE: this.deps.workspace,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sinain-core/src/mcp-tunnel/controller.tsView on unpkg · L122

sinain-knowledge/adapters/openclaw/adapter.tsView file

29const openclawJson = join(stateDir, "openclaw.json"); L30: const raw = JSON.parse(readFileSync(openclawJson, "utf-8")); L31: const token = raw?.channels?.telegram?.botToken ?? raw?.telegram?.botToken ?? null; ... L72: L73: private workspaceDir: string | null = null; L74: ... L128: } L129: let sessionsData: Record<string, Record<string, unknown>>; L130: try { ... L172: L173: const chatId = process.env.SINAIN_ALERT_CHAT_ID; L174: const token = readBotToken(stateDir);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

sinain-knowledge/adapters/openclaw/adapter.tsView on unpkg · L29

cli.jsView file

82if (process.argv.includes("--if-openclaw")) { L83: const ocJson = path.join(os.homedir(), ".openclaw/openclaw.json"); L84: if (!fs.existsSync(ocJson)) { ... L356: const targetWorkspace = path.join(HOME, ".sinain/workspace"); L357: fs.mkdirSync(targetWorkspace, { recursive: true }); L358: ... L394: } L395: fs.writeFileSync(envPath, content); L396: } else { L397: fs.mkdirSync(SINAIN_DIR, { recursive: true }); L398: const lines = Object.entries(envVars).map(([k, v]) => `${k}=${v}`); L399: fs.writeFileSync(envPath, lines.join("\n") + "\n");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli.jsView on unpkg · L82

install.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. { stdio: "inherit" }); console.log(" ✓ python dependencies installed"); } catch { try { execsync(`pip3 install -r "${reqfile}" --quiet`, { stdio: "inherit" }); console.log(" ✓ python dependencies installed"); } catch { console.warn(" ⚠ pip3 unavailable — python eval features disabled"); } } } await installlocal(); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.jsView on unpkg

sense_client/sender.pyView file

•path = sense_client/sender.py kind = build_helper sizeBytes = 419 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

sense_client/sender.pyView on unpkg

sense_client/tests/__init__.pyView file

•path = sense_client/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

sense_client/tests/__init__.pyView on unpkg

launcher.jsView file

•matchType = normalized_sha256 matchedPackage = @geravant/sinain@1.41.0 matchedPath = launcher.js matchedIdentity = npm:QGdlcmF2YW50L3NpbmFpbg:1.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

launcher.jsView on unpkg

setup-frpc.jsView file

•matchType = normalized_sha256 matchedPackage = @geravant/sinain@1.41.0 matchedPath = setup-frpc.js matchedIdentity = npm:QGdlcmF2YW50L3NpbmFpbg:1.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup-frpc.jsView on unpkg

setup-overlay.jsView file

•matchType = normalized_sha256 matchedPackage = @geravant/sinain@1.41.0 matchedPath = setup-overlay.js matchedIdentity = npm:QGdlcmF2YW50L3NpbmFpbg:1.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup-overlay.jsView on unpkg

setup-sck-capture.jsView file

•matchType = normalized_sha256 matchedPackage = @geravant/sinain@1.41.0 matchedPath = setup-sck-capture.js matchedIdentity = npm:QGdlcmF2YW50L3NpbmFpbg:1.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup-sck-capture.jsView on unpkg

sinain-core/src/index.tsView file

•matchType = token_shingles matchedPackage = @geravant/sinain@1.41.0 matchedPath = sinain-core/src/index.ts matchedIdentity = npm:QGdlcmF2YW50L3NpbmFpbg:1.41.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

sinain-core/src/index.tsView on unpkg