Loading npm security reports…

@indigoai-us/hq-cloud@6.16.26: Malicious npm security report | LPM Firewall

registry / @indigoai-us/hq-cloud / 6.16.26

@indigoai-us/hq-cloud@6.16.26

HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A normal sync that changes files automatically captures matching AI-agent transcripts and places them in the project's sync scope. The captured raw logs are then eligible for personal-vault cloud synchronization.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run a sync that downloads, tombstones, or removes a file.

Impact

Private prompts, responses, tool activity, and other transcript contents may be copied from the user's AI-agent log directory and uploaded to the configured vault.

Mechanism

Automatic AI session-log collection followed by cloud-sync inclusion.

Attack narrative

After a sync changes the local tree, the package calls reindex without a separate capture command. Reindex captures matching Codex, Claude, and Grok session logs into workspace/.session-logs. That directory is explicitly included in the personal-vault sync scope, so raw AI transcripts become eligible for remote transfer. Package comments asserting an operator directive do not establish user consent for this automatic collection and upload path.

AI rationale

The source establishes an automatic path from a normal sync to harvesting AI-agent session transcripts and adding them to cloud-sync input. This is concrete data exfiltration behavior, not a required implementation detail of a general sync engine.

Evidence

dist/cli/sync.jsdist/cli/reindex.jsdist/session-log-capture.jsdist/personal-vault.js~/.codex/sessions/**/*.jsonlworkspace/.session-logs/codex/**workspace/.session-logs/**

Source & flagged code

6 flagged · loading source

dist/machine-auth.test.jsView file

54async function importModule() { L55: return await import("./cognito-auth.js"); L56: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/machine-auth.test.jsView on unpkg · L54

dist/manifest/build-manifest.bench.test.jsView file

128// Print the numbers so a CI run records the trend, not just pass/fail. L129: process.stdout.write(`manifest stat-walk: ${result.walkStats.walkMs}ms, ` + L130: `${((rssAfter - rssBefore) / (1024 * 1024)).toFixed(1)}MB RSS for ${FILE_COUNT} files\n`); ... L323: // CI budget can be built on. L324: previousStateDir = process.env.HQ_STATE_DIR; L325: process.env.HQ_STATE_DIR = ledgerStateDir;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/manifest/build-manifest.bench.test.jsView on unpkg · L128

dist/lib/machine-id.jsView file

23* Resolution order (first hit wins, every miss falls through): L24: * 1. `process.env.HQ_MACHINE_ID` — explicit override for CI / tests. L25: * 2. `<hqRoot>/.hq/machine-id` — source-of-truth on the host. ... L42: * load) so tests overriding `HOME` post-import see the right file. Going L43: * through `os.homedir()` rather than `process.env.HOME` keeps the Windows L44: * USERPROFILE fallback intact. ... L75: const raw = fs.readFileSync(menubarJsonPath(), "utf-8"); L76: const parsed = JSON.parse(raw); L77: if (typeof parsed.machineId === "string" && parsed.machineId.length > 0) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/machine-id.jsView on unpkg · L23

dist/cli/reindex.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. _locked_exit }; emitreindextelemetry(opts, result, "locked"); return result; } if (err instanceof operationlockunwritableerror) { warn(err.message); const result = { status: operation_lock_unwritable_exit };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/reindex.jsView on unpkg

dist/cli/reindex.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/reindex.js#virtual:normalized:round1View on unpkg

dist/sync/area-ledger.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @indigoai-us/hq-cloud@6.16.24 matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsb3Vk:6.16.24 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/sync/area-ledger.test.jsView on unpkg

Source & flagged code

6 flagged

dist/machine-auth.test.jsView file

Lines 34-74javascript

34 vi.resetModules();

35});

36afterEach(() => {

37 vi.useRealTimers();

38 if (originalHome === undefined)

39 delete process.env.HOME;

40 else

41 process.env.HOME = originalHome;

42 if (originalUserProfile === undefined)

43 delete process.env.USERPROFILE;

44 else

45 process.env.USERPROFILE = originalUserProfile;

46 if (originalCredsEnv === undefined)

47 delete process.env.HQ_MACHINE_CREDS_FILE;

48 else

49 process.env.HQ_MACHINE_CREDS_FILE = originalCredsEnv;

50 fs.rmSync(tmpHome, { recursive: true, force: true });

51 vi.unstubAllGlobals();

52 vi.restoreAllMocks();

53});

54async function importModule() {

55 return await import("./cognito-auth.js");

56}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/machine-auth.test.jsView on unpkg · L54

57const CONFIG = {

58 region: "us-east-1",

59 userPoolDomain: "vault-indigo-hq-prod",

60 clientId: "test-client-id",

61};

62function writeCreds(creds = { username: "machine-agt_01TEST", secret: "s3cret" }) {

63 const dir = path.join(tmpHome, ".hq-agent");

64 fs.mkdirSync(dir, { recursive: true });

65 const file = path.join(dir, "machine-creds.json");

66 fs.writeFileSync(file, JSON.stringify(creds));

67 return file;

68}

69/** Build a fake JWT whose payload decodes to the given claims. */

70function fakeJwt(claims) {

71 const enc = (o) => Buffer.from(JSON.stringify(o)).toString("base64url");

72 return `${enc({ alg: "RS256", kid: "k" })}.${enc(claims)}.sig`;

73}

74function stubMintFetch(overrides = {}) {

dist/manifest/build-manifest.bench.test.jsView file

Lines 108-148javascript

108 const forceGc = acquireGc();

109 forceGc?.();

110 const rssBefore = process.memoryUsage().rss;

111 const

dist/lib/machine-id.jsView file

Lines 3-43javascript

3 * conflict mirrors, telemetry rows, and `.hq-conflicts/index.json` entries.

4 *

5 * Historically the menubar app (`indigoai-us/hq-sync`) was the sole writer

6 * of `machineId` via `~/.hq/menubar.json`, and every other sync caller

dist/cli/reindex.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. _locked_exit }; emitreindextelemetry(opts, result, "locked"); return result; } if (err instanceof operationlockunwritableerror) { warn(err.message); const result = { status: operation_lock_unwritable_exit };

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/reindex.jsView on unpkg

dist/cli/reindex.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/reindex.js#virtual:normalized:round1View on unpkg

dist/sync/area-ledger.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @indigoai-us/hq-cloud@6.16.24 matchedIdentity = npm:QGluZGlnb2FpLXVzL2hxLWNsb3Vk:6.16.24 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/sync/area-ledger.test.jsView on unpkg