Loading npm security reports…

@lifeaitools/clauth@2.0.1: AI-agent control-surface risk | LPM Firewall

registry / @lifeaitools/clauth / 2.0.1

@lifeaitools/clauth@2.0.1

Hardware-bound credential vault for the LIFEAI infrastructure stack

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On Windows installation, the package automatically alters Windows Terminal profiles for Claude and Codex and creates package-owned launchers. It also establishes a hidden elevated logon watchdog that restarts its daemon.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall on Windows

Impact

Future assistant launches can be routed through package-controlled scripts; the daemon persists across logons.

Mechanism

automatic AI-launcher configuration mutation plus scheduled-task persistence

Policy narrative

Installing the package triggers a Windows-only postinstall path that invokes its terminal-profile installer with a fixed repository path. That installer writes Claude and Codex Windows Terminal profiles and package-owned launcher scripts without an explicit user setup command. The same lifecycle hook copies a watchdog script and attempts to register an elevated hidden PowerShell task at logon; the watchdog continually starts the package daemon when its local endpoint is unavailable.

Rationale

The unconsented postinstall modifies a foreign AI-assistant launch surface and installs persistent elevated execution. This is a concrete install-time control-surface and persistence chain, not merely dormant CLI functionality.

Evidence

package.jsonscripts/postinstall.jscli/commands/codevelop.jscli/assets/codevelop/windows-terminal.profiles.jsoncli/assets/watchdog.ps1%APPDATA%\clauth\watchdog.ps1Windows Terminal settings.json

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.clauth-skill/references/keys-guide.mdView file

94patternName = github_pat severity = critical line = 94 matchedText = ghp[redacted]

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.clauth-skill/references/keys-guide.mdView on unpkg · L94

94patternName = github_pat severity = critical line = 94 matchedText = ghp[redacted]

Critical

Secret Pattern

GitHub personal access token in .clauth-skill/references/keys-guide.md

.clauth-skill/references/keys-guide.mdView on unpkg · L94

cli/watchdog-registry.jsView file

3import path from "path"; L4: import { spawnSync } from "child_process"; L5:

High

Child Process

Package source references child process execution.

cli/watchdog-registry.jsView on unpkg · L3

cli/fingerprint.jsView file

15// Cache path — avoids re-querying WMI/CIM on every daemon start. L16: // This eliminates the spawnSync cmd.exe ETIMEDOUT crash that occurs L17: // when PowerShell/WMI is slow on first call after boot.

High

Shell

Package source references shell execution.

cli/fingerprint.jsView on unpkg · L15

cli/supervisor-ui.test.jsView file

89addEventListener() {}, L90: body: makeElement('body'), L91: }, L92: async fetch(url, options) { L93: const opts = options || {}; ... L174: assert.equal(writes[0].options.headers['X-Clauth-Write-Token'], 'wt-fresh'); L175: assert.deepEqual(JSON.parse(writes[0].options.body), { action: 'restart' }); L176: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

cli/supervisor-ui.test.jsView on unpkg · L89

cli/commands/serve.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli/commands/serve.js: import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises"; headers: { "Authorization": `Bearer ${currentKey}`, "Content-Type": "application/json" }, headers: { "Authorization": `Bearer ${currentKey}`, "Content-Type": "application/json" }, headers: { "Authorization": `Bearer ${newKey}` }, headers: { "Authorization": `Bearer ${newKey}` }, "Authorization": `Bearer ${currentKey}`, headers: { "Authorization": `Bearer ${newKey}` }, headers: { "Authorization": `Bearer ${newKey}` },

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli/commands/serve.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli/commands/serve.js: import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises"; const listResp = await fetch("https://api.cloudflare.com/client/v4/user/tokens", { const createResp = await fetch("https://api.cloudflare.com/client/v4/user/tokens", { const verifyResp = await fetch("https://api.cloudflare.[redacted]", { await fetch(`https://api.cloudflare.com/client/v4/user/tokens/${currentToken.id}`, { const createResp = await fetch("https://registry.npmjs.org/-/npm/v1/tokens", { const listResp = await fetch("https://registry.npmjs.org/-/npm/v1/tokens", { await fetch(`https://registry.npmjs.org/-/npm/v1/tokens/

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli/commands/serve.jsView on unpkg

cli/index.jsView file

1119try { L1120: const r = await fetch(`http://127.0.0.1:52437/chitchat/${id}`, { signal: AbortSignal.timeout(3000) }); L1121: if (!r.ok) { ... L1131: // Find claude binary (same candidates as daemon) L1132: const { execSync: es, spawn } = await import("child_process"); L1133: let claudeBin = null; L1134: for (const c of [ L1135: process.env.CLAUDE_BIN, L1136: path.join(process.env.APPDATA || '', 'npm', 'claude.cmd'),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/index.jsView on unpkg · L1119

868try { L869: execSync("npm install -g @lifeaitools/clauth@latest", { stdio: "inherit" }); L870: console.log(chalk.green("\n Updated successfully.\n"));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/index.jsView on unpkg · L868

348patternName = generic_password severity = medium line = 348 matchedText = { type: ..." },

Medium

Secret Pattern

Hardcoded password in cli/index.js

cli/index.jsView on unpkg · L348

486patternName = generic_password severity = medium line = 486 matchedText = { type: ..." },

cli/commands/install.jsView file

21import { fileURLToPath } from 'url'; L22: import { execSync } from 'child_process'; L23: import Conf from 'conf'; ... L27: L28: const __dirname = dirname(fileURLToPath(import.meta.url)); L29: const ROOT = join(__dirname, '..', '..'); L30: const MGMT = 'https://api.supabase.com/v1'; L31: const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR || L32: (process.platform === 'win32' L33: ? join(process.env.USERPROFILE || '', '.claude', 'skills') ... L43: if (!_rl) { L44: _rl = createInterface({ input: process.stdin, output: process.stdout });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/commands/install.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/commands/install.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/install.jsView on unpkg

scripts/bin/bootstrap-win.exeView file

•path = scripts/bin/bootstrap-win.exe kind = native_binary sizeBytes = 37672227 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scripts/bin/bootstrap-win.exeView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1391 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

cli/commands/codevelop.jsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/commands/codevelop.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/codevelop.jsView on unpkg

cli/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/commands/doctor.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/doctor.jsView on unpkg

cli/studio-debug.jsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/studio-debug.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/studio-debug.jsView on unpkg

scripts/bootstrap.cjsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = scripts/bootstrap.cjs matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bootstrap.cjsView on unpkg

cli/commands/scrub.test.jsView file

17patternName = github_pat severity = critical line = 17 matchedText = const GH...hars

Critical

Secret Pattern

GitHub personal access token in cli/commands/scrub.test.js

cli/commands/scrub.test.jsView on unpkg · L17