@gigaflow/gmux@0.16.0
gmux — an LLM-native layer over your tmux workspace: browse, search and resume your AI coding agent sessions across Claude Code, Codex, and any other harness.
AI Security Review
scanned 2d ago · by lpm-firewall-aiWithout a config file, gmux enables background summaries by default and uses an available model CLI, even on the noninteractive path that skips setup. That can spend the user’s provider tokens and send session content without an explicit request, so this meets the rule for malicious automatic spending.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running ordinary gmux commands; the behavior is enabled by default when no config exists, including the noninteractive path that skips setup.
Impact
Unrequested provider usage can incur costs and sends session content to the selected model service.
Mechanism
A post-action hook starts a detached worker. It selects a detected provider CLI (or falls back to `claude -p`), distills session prompts and related details, and passes them to the provider for summarization.
Attack narrative
After a normal CLI action, gmux may start a detached worker that summarizes recent sessions. With no config, it treats this as allowed and chooses an installed model CLI or `claude -p`; the session-derived prompt is sent to that provider and can spend the user’s tokens. Interactive setup discloses the cost, but noninteractive first use skips that prompt while retaining the enabled default.
AI rationale
Without a config file, gmux enables background summaries by default and uses an available model CLI, even on the noninteractive path that skips setup. That can spend the user’s provider tokens and send session content without an explicit request, so this meets the rule for malicious automatic spending.
Evidence
dist/cli/main.jsdist/services/config.jsdist/services/auto-summarize.jsdist/services/summarize.jsdist/services/provider-process.jsdist/services/distill.js
Decision evidence
public snapshotAI called this Malicious at 92.0% confidence as Malware with low false-positive risk.
Evidence for block
- Most CLI actions automatically trigger a detached background summarization pass.
- When no config exists, gmux treats background summarization as allowed and selects a detected model CLI, falling back to `claude -p`.
- The pass sends distilled coding-session details to the provider CLI; the package documents that background model calls spend tokens.
- The package has no install, preinstall, or postinstall hook; its only publish lifecycle script is `prepublishOnly`.
- Interactive setup asks whether to enable background summaries and discloses token use, but the no-config, noninteractive path bypasses that prompt.
Evidence against
- Summarization supports gmux’s stated purpose of helping developers resume coding sessions.
- The configured provider is an installed model CLI, and the setup prompt discloses the token cost.
- Users can disable background calls with `GMUX_AUTO_SUMMARIZE=0`.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
5 flaggeddist/cli/picker.jsView file
13*/
L14: import { spawn, spawnSync } from "node:child_process";
L15: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/cli/picker.jsView on unpkg · L13dist/services/sensors.jsView file
1/**
L2: * Sensors: the two ways gmux learns what a pane is doing, unified behind one
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/services/sensors.jsView on unpkg · L1dist/services/providers.jsView file
49],
L50: install: "npm install -g @openai/codex",
L51: },
...
L56: return false;
L57: return spawnSync("which", [binary], { stdio: "ignore" }).status === 0;
L58: }
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/services/work-view.js
HighChild Processdist/cli/picker.js
HighRuntime Package Installdist/services/providers.js
HighSemantic Analysis Limiteddist/cli/commands/resume.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/services/sensors.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @gigaflow/gmux@0.16.0.
See all versions of @gigaflow/gmux for other recorded verdicts.
- Avoid installing @gigaflow/gmux@0.16.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.