registry / @lemonbeijing/lemonclaw-cli / 1.0.4

@lemonbeijing/lemonclaw-cli@1.0.4

Portable LemonClaw CLI launcher for WorkBuddy.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation fetches a remote runtime manifest and archive, then extracts and executes that runtime. The remote manifest supplies the expected hash, so the bundled package does not independently authenticate the payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

A party controlling the allowed download host can cause arbitrary code execution during npm installation.

Mechanism

remote payload download, extraction, and smoke-test execution

Attack narrative

On npm installation, postinstall bootstraps a platform runtime. It prefers a remote manifest from the vendor host, which supplies both archive URL and SHA-256. The package downloads and extracts that archive into ~/.lemonclaw-cli, then invokes its Python interpreter for a smoke test. Host restriction and hash verification do not authenticate a payload independently of the remote manifest; a compromised allowed host can provide matching malicious bytes and hash for immediate install-time execution.

Rationale

This is a remote-code bootstrap executed automatically at install time, with trust rooted solely in a remotely served manifest. It creates a concrete install-time arbitrary-code-execution supply-chain surface.

Evidence

package.jsondist/postinstall.cjsruntime-manifest.json~/.lemonclaw-cli

Network endpoints2

download.ningmengyun.com/Skills/lemonclaw/runtime-manifest.jsondownload.ningmengyun.com

@lemonbeijing/lemonclaw-cli@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code