registry / AI-agent control-surface risk / @geravant/sinain

@geravant/sinain

Context OS — ambient intelligence for builders. Captures screen + audio, distills into a private knowledge graph, accessible from MCP, web UI, and HUD overlay.

This report shows the evidence for @geravant/sinain@1.41.1. 2 of 6 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an unconsented postinstall mutation of a broad AI-agent control surface, not merely a package-local setup. The guarded detection does not obtain consent, and the same path also enables registry-driven replacement execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall when ~/.openclaw/openclaw.json exists

Impact

Enables a package-controlled agent extension, grants broad session tool visibility, exposes the gateway on LAN, and can execute a newer registry package.

Mechanism

automatic OpenClaw control-surface mutation and remote self-update execution

Policy narrative

Installing the package runs its postinstall hook. If OpenClaw is present, it automatically imports the installer, writes and enables the sinain-hud extension in OpenClaw configuration, sets global session tool visibility to all, and changes the gateway bind mode to LAN. Before dispatch, the CLI may fetch the latest npm version and execute it through npx.

AI rationale

Evidence

package.jsoncli.jsinstall.jsself-update.js~/.openclaw/extensions/sinain-hud~/.openclaw/sinain-sources~/.openclaw/openclaw.json~/.openclaw/workspace

Network endpoints1

registry.npmjs.org/@geravant/sinain/latest

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

postinstall invokes `install --if-openclaw`.
When OpenClaw exists, installation proceeds without user confirmation.
Installer enables its plugin and changes global OpenClaw tool visibility.
Installer exposes the OpenClaw gateway on LAN.
CLI self-updates by executing the newest registry version.

Evidence against

The install path is gated on an existing OpenClaw config.
Configuration names a package-owned `sinain-hud` extension rather than an unrelated agent entry.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 107 file(s), 1.39 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.anthropic.com, api.cerebras.ai, api.github.com, api.telegram.org, ar.sinain.com, auth.sinain.com, cdn.jsdelivr.net, docs.flutter.dev, github.com, huggingface.co, mcp.sinain.com, openrouter.ai, registry.npmjs.org, sinain.com, turn.sinain.com

Source & flagged code

16 flagged

package.jsonView file

•scripts.postinstall = node cli.js install --if-openclaw

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli.js install --if-openclaw

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

sinain-core/src/capture/voice-session.tsView file

1import { spawn, type ChildProcess } from "node:child_process"; L2: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

sinain-core/src/capture/voice-session.tsView on unpkg · L1

setup-embedding.jsView file

113// to guarantee the same module instance (and cache key) as the runtime. L114: const require = createRequire(path.join(CORE_DIR, "package.json")); L115: // Use dynamic import with the resolved path — createRequire gives us the path

Medium

Dynamic Require

Package source references dynamic require/import behavior.

setup-embedding.jsView on unpkg · L113

sinain-core/src/capture/window-ops.tsView file

26function maxWindowChars(): number { L27: const v = parseInt(process.env.SINAIN_BURST_MAX_CHARS || "", 10); L28: return Number.isFinite(v) && v > 0 ? v : DEFAULT_MAX_WINDOW_CHARS;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

sinain-core/src/capture/window-ops.tsView on unpkg · L26

sinain-core/src/mcp-tunnel/controller.tsView file

122const entry = resolve(this.deps.packageRoot, "sinain-mcp-server", "index.ts"); L123: this.mcpHttp = spawn(tsxBin, [entry], { L124: env: { L125: ...process.env, L126: MCP_TRANSPORT: "http", L127: MCP_HTTP_PORT: String(MCP_HTTP_PORT), L128: SINAIN_CORE_URL: process.env.SINAIN_CORE_URL || `http://localhost:${this.deps.corePort}`, L129: SINAIN_WORKSPACE: this.deps.workspace,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sinain-core/src/mcp-tunnel/controller.tsView on unpkg · L122

sinain-knowledge/adapters/openclaw/adapter.tsView file

29const openclawJson = join(stateDir, "openclaw.json"); L30: const raw = JSON.parse(readFileSync(openclawJson, "utf-8")); L31: const token = raw?.channels?.telegram?.botToken ?? raw?.telegram?.botToken ?? null; ... L72: L73: private workspaceDir: string | null = null; L74: ... L128: } L129: let sessionsData: Record<string, Record<string, unknown>>; L130: try { ... L172: L173: const chatId = process.env.SINAIN_ALERT_CHAT_ID; L174: const token = readBotToken(stateDir);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

sinain-knowledge/adapters/openclaw/adapter.tsView on unpkg · L29

cli.jsView file

82if (process.argv.includes("--if-openclaw")) { L83: const ocJson = path.join(os.homedir(), ".openclaw/openclaw.json"); L84: if (!fs.existsSync(ocJson)) { ... L356: const targetWorkspace = path.join(HOME, ".sinain/workspace"); L357: fs.mkdirSync(targetWorkspace, { recursive: true }); L358: ... L394: } L395: fs.writeFileSync(envPath, content); L396: } else { L397: fs.mkdirSync(SINAIN_DIR, { recursive: true }); L398: const lines = Object.entries(envVars).map(([k, v]) => `${k}=${v}`); L399: fs.writeFileSync(envPath, lines.join("\n") + "\n");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli.jsView on unpkg · L82

install.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. { stdio: "inherit" }); console.log(" ✓ python dependencies installed"); } catch { try { execsync(`pip3 install -r "${reqfile}" --quiet`, { stdio: "inherit" }); console.log(" ✓ python dependencies installed"); } catch { console.warn(" ⚠ pip3 unavailable — python eval features disabled"); } } } await installlocal(); }

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

install.jsView on unpkg

sense_client/sender.pyView file

•path = sense_client/sender.py kind = build_helper sizeBytes = 419 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

sense_client/sender.pyView on unpkg

sense_client/tests/__init__.pyView file

•path = sense_client/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

sense_client/tests/__init__.pyView on unpkg

launcher.jsView file

•matchType = normalized_sha256 matchedPackage = @geravant/sinain@1.41.0 matchedPath = launcher.js matchedIdentity = npm:QGdlcmF2YW50L3NpbmFpbg:1.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High