Loading npm security reports…

@geravant/sinain@1.41.0: AI-agent control-surface risk | LPM Firewall

registry / @geravant/sinain / 1.41.0

@geravant/sinain@1.41.0

Context OS — ambient intelligence for builders. Captures screen + audio, distills into a private knowledge graph, accessible from MCP, web UI, and HUD overlay.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package on a host with OpenClaw silently modifies and restarts that agent platform. It enables a bundled plugin, broadens tool visibility, and exposes the gateway on the LAN.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall when ~/.openclaw/openclaw.json exists

Impact

Unconsented expansion and network exposure of an existing AI-agent control surface.

Mechanism

automatic OpenClaw configuration mutation and gateway restart

Policy narrative

The package’s postinstall detects OpenClaw and automatically imports install.js. The installer writes OpenClaw’s configuration, enables its plugin, changes sandbox tool visibility to "all", changes gateway binding to "lan", and restarts the gateway. This is an unconsented install-time mutation of a foreign AI-agent control surface, not an explicit setup command.

Rationale

Source inspection confirms concrete install-time OpenClaw control-surface changes and gateway exposure. The OpenClaw-presence guard does not establish user consent.

Evidence

package.jsoncli.jsinstall.jsindex.tsopenclaw.plugin.jsonsinain-knowledge/adapters/openclaw/adapter.ts~/.openclaw/openclaw.json~/.openclaw/extensions/sinain-hud/index.ts~/.openclaw/extensions/sinain-hud/openclaw.plugin.json~/.openclaw/sinain-sources

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli.js install --if-openclaw

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli.js install --if-openclaw

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

sinain-core/src/capture/voice-session.tsView file

1import { spawn, type ChildProcess } from "node:child_process"; L2: import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

sinain-core/src/capture/voice-session.tsView on unpkg · L1

setup-embedding.jsView file

113// to guarantee the same module instance (and cache key) as the runtime. L114: const require = createRequire(path.join(CORE_DIR, "package.json")); L115: // Use dynamic import with the resolved path — createRequire gives us the path

Medium

Dynamic Require

Package source references dynamic require/import behavior.

setup-embedding.jsView on unpkg · L113

sinain-core/src/capture/window-ops.tsView file

26function maxWindowChars(): number { L27: const v = parseInt(process.env.SINAIN_BURST_MAX_CHARS || "", 10); L28: return Number.isFinite(v) && v > 0 ? v : DEFAULT_MAX_WINDOW_CHARS;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

sinain-core/src/capture/window-ops.tsView on unpkg · L26

sinain-core/src/mcp-tunnel/controller.tsView file

122const entry = resolve(this.deps.packageRoot, "sinain-mcp-server", "index.ts"); L123: this.mcpHttp = spawn(tsxBin, [entry], { L124: env: { L125: ...process.env, L126: MCP_TRANSPORT: "http", L127: MCP_HTTP_PORT: String(MCP_HTTP_PORT), L128: SINAIN_CORE_URL: process.env.SINAIN_CORE_URL || `http://localhost:${this.deps.corePort}`, L129: SINAIN_WORKSPACE: this.deps.workspace,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

sinain-core/src/mcp-tunnel/controller.tsView on unpkg · L122

sinain-knowledge/adapters/openclaw/adapter.tsView file

29const openclawJson = join(stateDir, "openclaw.json"); L30: const raw = JSON.parse(readFileSync(openclawJson, "utf-8")); L31: const token = raw?.channels?.telegram?.botToken ?? raw?.telegram?.botToken ?? null; ... L72: L73: private workspaceDir: string | null = null; L74: ... L128: } L129: let sessionsData: Record<string, Record<string, unknown>>; L130: try { ... L172: L173: const chatId = process.env.SINAIN_ALERT_CHAT_ID; L174: const token = readBotToken(stateDir);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

sinain-knowledge/adapters/openclaw/adapter.tsView on unpkg · L29

cli.jsView file

82if (process.argv.includes("--if-openclaw")) { L83: const ocJson = path.join(os.homedir(), ".openclaw/openclaw.json"); L84: if (!fs.existsSync(ocJson)) { ... L356: const targetWorkspace = path.join(HOME, ".sinain/workspace"); L357: fs.mkdirSync(targetWorkspace, { recursive: true }); L358: ... L394: } L395: fs.writeFileSync(envPath, content); L396: } else { L397: fs.mkdirSync(SINAIN_DIR, { recursive: true }); L398: const lines = Object.entries(envVars).map(([k, v]) => `${k}=${v}`); L399: fs.writeFileSync(envPath, lines.join("\n") + "\n");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli.jsView on unpkg · L82

sense_client/sender.pyView file

•path = sense_client/sender.py kind = build_helper sizeBytes = 419 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

sense_client/sender.pyView on unpkg

sense_client/tests/__init__.pyView file

•path = sense_client/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

sense_client/tests/__init__.pyView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-33json

1{

2 "name": "@geravant/sinain",

3 "version": "1.41.0",

4 "description": "Context OS — ambient intelligence for builders. Captures screen + audio, distills into a private knowledge graph, accessible from MCP, web UI, and HUD overlay.",

5 "type": "module",

6 "bin": {

7 "sinain": "./cli.js",

8 "sinain-knowledge": "./sinain-knowledge/deploy/cli.ts"

9 },

10 "scripts": {

11 "prepack": "node pack-prepare.js pre",

12 "postpack": "node pack-prepare.js post",

13 "postinstall": "node cli.js install --if-openclaw"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 },

15 "files": [

16 "cli.js",

17 "self-update.js",

18 "config.js",

19 "config-shared.js",

20 "encrypted-store.js",

21 "wipe-data.js",

22 "onboard.js",

23 "launcher.js",

24 "mcp-register.js",

25 "setup-overlay.js",

26 "setup-sck-capture.js",

27 "setup-embedding.js",

28 "setup-frpc.js",

29 "pack-prepare.js",

30 "install.js",

31 "index.ts",

32 "openclaw.plugin.json",

33 "sinain-memory",

sinain-core/src/capture/voice-session.tsView file

Lines 1-21typescript

1import { spawn, type ChildProcess } from "node:child_process";

2import { randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

sinain-core/src/capture/voice-session.tsView on unpkg · L1

3import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from

setup-embedding.jsView file

Lines 93-133javascript

93 _log("Force update requested — re-downloading model...");

94 }

95

96 // Verify sinain-core's node_modules are present (installDeps runs first in launcher)

97 const transformersPath = path.join(CORE_DIR, "node_modules", "@huggingface"

sinain-core/src/capture/window-ops.tsView file

Lines 6-46typescript

6

7/**

8 * Deliberate-capture window operations: assemble a time-range slice of the

9 * rolling window (feed + sense), describe its coverage for free (no LLM), and

10 * run the burst-lane gestures (summon → situation brief, enrich → context card).

11 */

12

13// One burst call handles ≤ ~60 min at median density (benchmarked: 34K tok

14// prefill = 1.38s on Cerebras). Beyond this we truncate oldest-first and flag

15// the brief as partial — honest coverage beats a stalled gesture.

16

sinain-core/src/mcp-tunnel/controller.tsView file

Lines 102-142typescript

102 void this.refreshAccount(); // reflect account link state in the panel

103 if (this.accountTimer) clearInterval(this.accountTimer);

104 this.accountTimer = setInterval(()

sinain-knowledge/adapters/openclaw/adapter.tsView file

Lines 9-49typescript

9import { readFileSync, writeFileSync, existsSync, statSync, copyFileSync } from "node:fs";

10import { join, dirname } from "node:path";

11

12import type { ScriptResult } from "../../data/schema.js";

13import

cli.jsView file

Lines 62-102javascript

62 case "setup-sck-capture": {

63 const { downloadBinary } = await import("./setup-sck-capture.js");

64 if (os.platform() === "win32") {

65 console.log("sck-capture is macOS-only (Windows uses win-audio-capture.exe)");

66 } else {

67

sense_client/sender.pyView file

•path = sense_client/sender.py kind = build_helper sizeBytes = 419 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

sense_client/sender.pyView on unpkg

sense_client/tests/__init__.pyView file

•path = sense_client/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

sense_client/tests/__init__.pyView on unpkg