registry / Malware / @luckydraw/cumulus

@luckydraw/cumulus

RLM-based CLI chat wrapper for Claude with external history context management

This report shows the evidence for @luckydraw/cumulus@1.0.61. 6 of 59 known versions are blocked or flagged. The newest version, 1.0.69, is flagged. See all versions.

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The runtime gateway prompt contains an explicit attempt to override higher-priority agent instructions and conceal the override. This concrete control manipulation supports blocking publication.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Runtime use of the gateway agent.

Impact

This can undermine the agent's instruction hierarchy and hide that behavior from the user.

Mechanism

A package-provided prompt directs the agent to disregard conflicting system instructions and follow the package's task-tracking convention without acknowledging the conflict.

Attack narrative

The gateway prompt contains review-directed override behavior: it instructs an agent to silently disregard conflicting system reminders or tool registrations and to avoid acknowledging the conflict. This is active instruction manipulation in the runtime agent context, rather than an inert carrier. The inspected manifest hooks do not trigger it during installation; it is reached through runtime gateway use.

AI rationale

The runtime gateway prompt contains an explicit attempt to override higher-priority agent instructions and conceal the override. This concrete control manipulation supports blocking publication.

Evidence

dist/lib/gateway.js

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The gateway prompt tells its downstream agent to ignore conflicting system reminders and tool registrations, follow package-defined task tracking, and conceal that conflict.
The package exposes the gateway as a runtime command; the prompt behavior is part of runtime agent operation.

Evidence against

The manifest lifecycle hooks are build preparation and Husky setup; they do not themselves establish install-time execution of the prompt behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings

Manifest

NoLicense

scanned 129 file(s), 5.91 MB of source, external domains: 127.0.0.1, api.example.com, api.openai.com, api.search.brave.com, app.texitool.com, plastic.luckydraw.dev, registry.npmjs.org, router.huggingface.co, www.apple.com, www.eclipse.org, www.w3.org

Source & flagged code

8 flagged

dist/tui/hooks/useClaudeProcess.jsView file

Lines 1-23javascript

1/**

2 * Hook for managing Claude subprocess and streaming.

3 */

4import { spawn } from 'child_process';

5import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

6import { ContextBudget } from '../../lib/context-budget.js';

7import { StreamProcessor } from '../../lib/stream-processor.js';

8import { extractTextFromStreamLine } from '../utils/streamParser.js';

9export function useClaudeProcess(options) {

10 const { mcpConfigPath, contentStore, onText, onComplete, onError, onExternalize, onTTFT } = options;

11 const processRef = useRef(null);

12 const responseRef = useRef('');

13 const bufferRef = useRef('');

14 const completedRef = useRef(false);

15 const spawnTimeRef = useRef(0);

16 const ttftFiredRef = useRef(false);

17 const kill = useCallback(() => {

18 const partial = responseRef.current;

19 if (processRef.current) {

20 processRef.current.kill('SIGTERM');

21 processRef.current = null;

22 }

23 return partial;

dist/lib/gateway.jsView file

Lines 2509-2549javascript

2509 // under --permission-mode bypassPermissions it is a guaranteed no-op — so deny-by-default

2510 // has to be expressed as a denylist. Gated on the field being present so an unconstrained

2511 // thread never pays for the inventory probe (a subprocess spawn) at all.

2512 const effectiveDisallowedTools = mergedConfig.allowedTools

2513 ? compileDisallowedTools(mergedConfig.allowedTools, await

dist/gateway/server.jsView file

Lines 1-31javascript

1/**

2 * Gateway HTTP server — exposes the cumulus message pipeline as a REST API

3 * with SSE streaming. Channel adapters and remote clients connect here.

4 *

5 * Endpoints:

6 * POST /api/thread/:name/message — submit message, SSE stream response

7 * POST /api/thread/:name/sync — sync messages from local mode (store only, no Claude)

8 * GET /api/thread/:name/history — recent messages

9 * GET /api/thread/:name/status — thread info + adaptive state

10 * GET /api/threads — list all threads

dist/gateway/setup.jsView file

Lines 1-27javascript

1/**

2 * cumulus-gateway setup wizard and config management.

3 *

4 * Phase 1: `cumulus-gateway setup --project-root <path>` — instant non-interactive setup

5 * Phase 2: `cumulus-gateway setup` — interactive prompts with auto-detection

6 * Phase 4: `cumulus-gateway config set/get/list` — post-install config changes

7 */

8import { execSync } from 'child_process';

9import

dist/lib/version-check.jsView file

Lines 159-199javascript

159export function saveUpdateState(from, to) {

160 const state = {

161 previousVersion: from,

162 updatedAt: new Date().toISOString

dist/gateway/daemon.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/gateway/daemon.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @luckydraw/cumulus@1.0.4 matchedIdentity = npm:QGx1Y2t5ZHJhdy9jdW11bHVz:1.0.4 similarity = 0.535 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/gateway.jsView on unpkg

2529// Windows: spawn() can't directly exec .cmd/.bat shims (CVE-2024-27980). L2530: // Routing through cmd.exe is required for the npm-installed `claude.cmd`. L2531: const isWindowsShim = process.platform === 'win32' && /\.(cmd|bat|ps1)$/i.test(resolvedClaudePath);

Findings

1 Critical5 High4 Medium9 Low

CriticalPrevious Version Dangerous Deltadist/lib/gateway.js

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

HighSemantic Analysis Limiteddist/gateway/daemon.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

Low

Affected versions and remediation

This report applies to @luckydraw/cumulus@1.0.61.

The versions list below shows the verdict for each recorded version.

Avoid installing @luckydraw/cumulus@1.0.61. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-20 10:48:54.106Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

59 known versions

1.0.69latestSuspiciousAI-agent capability abuseWarnPublishedOct 3, 2026, 8:39 PM 1.0.67Clean—AllowPublishedSep 29, 2026, 7:48 PM 1.0.66Clean—AllowPublishedSep 25, 2026, 4:46 PM 1.0.63Manual Review—AllowUnder ReviewSep 23, 2026, 6:38 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code