@grum-os/cli@0.3.10
Keep a repository on the design contract reviewed in Grum: a local drift check, review requests, Cursor hooks and an MCP server.
AI Security Review
scanned 29d ago · by lpm-firewall-aiSource confirms explicit-command agent configuration changes and an unpinned executable integration, warranting a capability warning. The absence of npm lifecycle hooks and the inspected consent and credential handling do not support blocking as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Running grum init cursor or accepting Cursor configuration during setup.
Impact
Changes agent instructions and tool execution, with later tool launches potentially resolving newer CLI code.
Mechanism
Writes hooks, a Grum MCP server entry, and an always-applied rule; the MCP command invokes an unpinned npm package.
AI rationale
Source confirms explicit-command agent configuration changes and an unpinned executable integration, warranting a capability warning. The absence of npm lifecycle hooks and the inspected consent and credential handling do not support blocking as malware.
Evidence
grum.mjs.cursor/hooks.json.cursor/mcp.json.cursor/rules/grum.mdc.gitignore
Network endpoints1
app.grum.so
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes grum.mjs as the CLI and declares no lifecycle scripts or runtime dependencies.
- The explicit init cursor command writes repository-local Cursor hooks and MCP configuration.
- Interactive setup asks whether to configure Cursor agents before invoking configuration writes.
- Installed MCP and pre-commit commands use an unpinned npx invocation, allowing later executions to resolve a newer CLI release.
- The generated always-applied Cursor rule directs agents to call Grum contract and check tools.
- Saved Grum credentials are selected by API origin and checked against that origin.
Evidence against
- No unconsented npm install-time agent configuration mutation was found.
- Inspected Git output and outbound requests support design checks and review reports; they do not establish covert exfiltration.
- Configuration helpers preserve unrelated hooks and MCP server entries.
Behavioral surface
ChildProcessEnvironmentVarsNetworkWebSocket
Source & flagged code
8 flaggedgrum.mjsView file
81${t.fix}`:""}`).join(`
L82: `)}function Va(e,t,n,r){let o=e?.profile,s=o?.info_cache;if(!s||typeof s!="object")return null;let i=new Set([...n,...r==="store"?[bo]:[]]),a=Object.keys(s).sort((l,c)=>l===o?.last...
L83: `),Og="\x1B[38;2;28;142;241m",Ng="\x1B[38;2;196;160;0m",Dn="\x1B[0m",Ya=e=>`${Og}${e}${Dn}`,Fg=[{name:"check",blurb:"Check your changes against the design contract"},{name:"setup",...
High
79L80: ${Da(n,!1)}`}}var Rg="2025-06-18",In=e=>`Check before you finish. ${It(e)}`,Ag=e=>({grum_contract:`Grum design contract: this repository's design contract as reviewed in Grum: its ...
L81: ${t.fix}`:""}`).join(`
L82: `)}function Va(e,t,n,r){let o=e?.profile,s=o?.info_cache;if(!s||typeof s!="object")return null;let i=new Set([...n,...r==="store"?[bo]:[]]),a=Object.keys(s).sort((l,c)=>l===o?.last...
L83: `),Og="\x1B[38;2;28;142;241m",Ng="\x1B[38;2;196;160;0m",Dn="\x1B[0m",Ya=e=>`${Og}${e}${Dn}`,Fg=[{name:"check",blurb:"Check your changes against the design contract"},{name:"setup",...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
grum.mjsView on unpkg · L7996`)}function ll(e,t,n=!1){let r=Lt(n),o=r.length,s=(t.name??"").toLowerCase();if(t.sequence===""||t.ctrl&&s==="c")return{type:"interrupt"};if(s==="up"||s==="k")return{type:"move",i...
L97: `,{mode:384}),Wg(n,384)}function Sl(e,t=On()){Kg(Ro(e,t),{force:!0})}import{fileURLToPath as Xg}from"node:url";var F=vl("https://app.grum.so"),st=globalThis.__GRUM_VERSION__??"0.0....
L98: `){let r=jl({input:process.stdin,output:process.stderr}),o=!1;r.on("SIGINT",()=>{process.stderr.write(`
L99: `),process.exit(130)}),r.on("close",()=>{o||process.exit(130)});try{for(;;){let s=t(await r.question(e));if(s!=null)return o=!0,s;process.stderr.write(n)}}finally{o=!0,r.close()}}v...
L100: `);let r=jl({input:process.stdin,output:process.stderr}),o=!1;r.on("line",()=>{o=!0}),r.on("SIGINT",()=>{process.stder
Findings
4 High6 Medium2 Low
HighChild Processgrum.mjs
HighSame File Env Network Executiongrum.mjs
HighCommand Output Exfiltrationgrum.mjs
HighTrigger Reachable Command Output Exfiltrationgrum.mjs
MediumNetwork
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencegrum.mjs
MediumAi Review Evidencegrum.mjs
MediumAi Review Evidencegrum.mjs
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @grum-os/cli@0.3.10.
See all versions of @grum-os/cli for other recorded verdicts.
- Review the evidence and your use of @grum-os/cli@0.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.