Loading npm security reports…

@lifeaitools/clauth@2.0.2: AI-agent control-surface risk | LPM Firewall

registry / @lifeaitools/clauth / 2.0.2

@lifeaitools/clauth@2.0.2

Hardware-bound credential vault for the LIFEAI infrastructure stack

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On Windows npm postinstall establishes a persistent watchdog and alters Windows Terminal with Claude/Codex launcher profiles. It also performs unattended third-party dependency installation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation on Windows

Impact

A package install changes startup behavior and a foreign terminal/agent launch surface before an explicit clauth command.

Mechanism

postinstall persistence plus AI-agent terminal-profile mutation

Policy narrative

During Windows npm installation, the postinstall hook copies and registers a hidden logon watchdog that restarts clauth, invokes an installer that rewrites Windows Terminal settings with Claude and Codex launcher profiles, and may silently install rclone and PowerShell. These are unconsented install-time mutations of persistence and an AI-agent-adjacent control surface.

Rationale

The package performs concrete, automatic Windows persistence and foreign Terminal profile mutation from npm postinstall. This exceeds a normal CLI install hook and meets the install-time AI-agent control-surface block boundary. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.

Evidence

package.jsonscripts/postinstall.jscli/assets/watchdog.ps1cli/commands/codevelop.jscli/assets/codevelop/windows-terminal.profiles.json

Network endpoints1

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.clauth-skill/references/keys-guide.mdView file

94patternName = github_pat severity = critical line = 94 matchedText = ghp[redacted]

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.clauth-skill/references/keys-guide.mdView on unpkg · L94

94patternName = github_pat severity = critical line = 94 matchedText = ghp[redacted]

Critical

Secret Pattern

GitHub personal access token in .clauth-skill/references/keys-guide.md

.clauth-skill/references/keys-guide.mdView on unpkg · L94

cli/watchdog-registry.jsView file

3import path from "path"; L4: import { spawnSync } from "child_process"; L5:

High

Child Process

Package source references child process execution.

cli/watchdog-registry.jsView on unpkg · L3

cli/fingerprint.jsView file

15// Cache path — avoids re-querying WMI/CIM on every daemon start. L16: // This eliminates the spawnSync cmd.exe ETIMEDOUT crash that occurs L17: // when PowerShell/WMI is slow on first call after boot.

High

Shell

Package source references shell execution.

cli/fingerprint.jsView on unpkg · L15

cli/supervisor-ui.test.jsView file

89addEventListener() {}, L90: body: makeElement('body'), L91: }, L92: async fetch(url, options) { L93: const opts = options || {}; ... L174: assert.equal(writes[0].options.headers['X-Clauth-Write-Token'], 'wt-fresh'); L175: assert.deepEqual(JSON.parse(writes[0].options.body), { action: 'restart' }); L176: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

cli/supervisor-ui.test.jsView on unpkg · L89

cli/commands/serve.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli/commands/serve.js: import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises"; headers: { "Authorization": `Bearer ${currentKey}`, "Content-Type": "application/json" }, headers: { "Authorization": `Bearer ${currentKey}`, "Content-Type": "application/json" }, headers: { "Authorization": `Bearer ${newKey}` }, headers: { "Authorization": `Bearer ${newKey}` }, "Authorization": `Bearer ${currentKey}`, headers: { "Authorization": `Bearer ${newKey}` }, headers: { "Authorization": `Bearer ${newKey}` },

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli/commands/serve.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli/commands/serve.js: import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises"; const listResp = await fetch("https://api.cloudflare.com/client/v4/user/tokens", { const createResp = await fetch("https://api.cloudflare.com/client/v4/user/tokens", { const verifyResp = await fetch("https://api.cloudflare.[redacted]", { await fetch(`https://api.cloudflare.com/client/v4/user/tokens/${currentToken.id}`, { const createResp = await fetch("https://registry.npmjs.org/-/npm/v1/tokens", { const listResp = await fetch("https://registry.npmjs.org/-/npm/v1/tokens", { await fetch(`https://registry.npmjs.org/-/npm/v1/tokens/

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli/commands/serve.jsView on unpkg

cli/index.jsView file

1119try { L1120: const r = await fetch(`http://127.0.0.1:52437/chitchat/${id}`, { signal: AbortSignal.timeout(3000) }); L1121: if (!r.ok) { ... L1131: // Find claude binary (same candidates as daemon) L1132: const { execSync: es, spawn } = await import("child_process"); L1133: let claudeBin = null; L1134: for (const c of [ L1135: process.env.CLAUDE_BIN, L1136: path.join(process.env.APPDATA || '', 'npm', 'claude.cmd'),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/index.jsView on unpkg · L1119

868try { L869: execSync("npm install -g @lifeaitools/clauth@latest", { stdio: "inherit" }); L870: console.log(chalk.green("\n Updated successfully.\n"));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/index.jsView on unpkg · L868

348patternName = generic_password severity = medium line = 348 matchedText = { type: ..." },

Medium

Secret Pattern

Hardcoded password in cli/index.js

cli/index.jsView on unpkg · L348

486patternName = generic_password severity = medium line = 486 matchedText = { type: ..." },

cli/commands/install.jsView file

21import { fileURLToPath } from 'url'; L22: import { execSync } from 'child_process'; L23: import Conf from 'conf'; ... L27: L28: const __dirname = dirname(fileURLToPath(import.meta.url)); L29: const ROOT = join(__dirname, '..', '..'); L30: const MGMT = 'https://api.supabase.com/v1'; L31: const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR || L32: (process.platform === 'win32' L33: ? join(process.env.USERPROFILE || '', '.claude', 'skills') ... L43: if (!_rl) { L44: _rl = createInterface({ input: process.stdin, output: process.stdout });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/commands/install.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/commands/install.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/install.jsView on unpkg

scripts/bin/bootstrap-win.exeView file

•path = scripts/bin/bootstrap-win.exe kind = native_binary sizeBytes = 37672227 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scripts/bin/bootstrap-win.exeView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1391 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

cli/commands/codevelop.jsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/commands/codevelop.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/codevelop.jsView on unpkg

cli/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/commands/doctor.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/commands/doctor.jsView on unpkg

cli/studio-debug.jsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = cli/studio-debug.js matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/studio-debug.jsView on unpkg

scripts/bootstrap.cjsView file

•matchType = normalized_sha256 matchedPackage = @lifeaitools/clauth@1.30.24 matchedPath = scripts/bootstrap.cjs matchedIdentity = npm:QGxpZmVhaXRvb2xzL2NsYXV0aA:1.30.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bootstrap.cjsView on unpkg

cli/commands/scrub.test.jsView file

17patternName = github_pat severity = critical line = 17 matchedText = const GH...hars

Critical

Secret Pattern

GitHub personal access token in cli/commands/scrub.test.js

cli/commands/scrub.test.jsView on unpkg · L17