registry / AI-agent capability abuse / @luckydraw/cumulus / 0.31.61

@luckydraw/cumulus@0.31.61

RLM-based CLI chat wrapper for Claude with external history context management

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No automatic malicious lifecycle behavior was confirmed, so blocking is not justified. The forced permission bypass combined with local-file and outbound agent tools warrants a warning.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs cumulus or cumulus-gateway and submits a chat message.

Impact

A prompt-influenced agent could modify accessible files or transmit selected local content through enabled runtime tools.

Mechanism

Permission-bypassed AI subprocess with file-reading and outbound MCP tools.

AI rationale

No automatic malicious lifecycle behavior was confirmed, so blocking is not justified. The forced permission bypass combined with local-file and outbound agent tools warrants a warning.

Evidence

package.jsondist/lib/gateway.jsdist/tui/hooks/useClaudeProcess.jsdist/gateway/gateway-agents-mcp.jsdist/gateway/setup.js~/.cumulus/mcp-config-<timestamp>.json

Network endpoints2

api.resend.complastic.luckydraw.dev/api/apps

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

dist/lib/gateway.js spawns Claude with bypassPermissions.
dist/tui/hooks/useClaudeProcess.js also forces bypassPermissions.
dist/lib/gateway.js injects mandatory agent instructions and creates MCP configs.
dist/gateway/gateway-agents-mcp.js lets the agent read arbitrary local files for upload.
MCP can send data to api.resend.com and plastic.luckydraw.dev.
Agent scheduling enables recurring system-level prompt injection.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Gateway setup and service persistence require explicit cumulus-gateway setup plus an interactive confirmation.
Observed network actions are runtime features, not import/install-time behavior.
No confirmed credential harvesting or covert exfiltration path was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

7 flagged

dist/tui/hooks/useClaudeProcess.jsView file

Lines 1-23javascript

1/**

2 * Hook for managing Claude subprocess and streaming.

3 */

4import { spawn } from 'child_process';

5import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

6import { ContextBudget } from '../../lib/context-budget.js';

7import { StreamProcessor } from '../../lib/stream-processor.js';

8import { extractTextFromStreamLine } from '../utils/streamParser.js';

9export function useClaudeProcess(options) {

10 const { mcpConfigPath, contentStore, onText, onComplete, onError, onExternalize, onTTFT } = options;

11 const processRef = useRef(null);

12 const responseRef = useRef('');

13 const bufferRef = useRef('');

14 const completedRef = useRef(false);

15 const spawnTimeRef = useRef(0);

16 const ttftFiredRef = useRef(false);

17 const kill = useCallback(() => {

18 const partial = responseRef.current;

19 if (processRef.current) {

20 processRef.current.kill('SIGTERM');

21 processRef.current = null;

22 }

23 return partial;

dist/lib/gateway.jsView file

Lines 1774-1814javascript

1774 '--permission-mode',

1775 'bypassPermissions',

1776 '--mcp-config',

1777 mcpConfigPath,

1778 '--strict-mcp-config',

1779 '--input-format',

1780 'stream-json'

dist/gateway/server.jsView file

16*/ L17: import { execFileSync } from 'child_process'; L18: import * as crypto from 'crypto'; L19: import * as fs from 'fs'; L20: import * as http from 'http'; L21: import * as os from 'os'; ... L64: headers: { 'Content-Type': 'application/json' }, L65: body: JSON.stringify({ L66: command: 'records.get', ... L69: }); L70: const record = (await upstream.json()); L71: if (record?.ok) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/gateway/server.jsView on unpkg · L16

dist/gateway/setup.jsView file

7Trigger-reachable persistence chain: manifest.bin -> dist/gateway/daemon.js -> dist/gateway/setup.js L7: */ L8: import { execSync } from 'child_process'; L9: import { randomBytes } from 'crypto'; ... L12: import * as path from 'path'; L13: const CUMULUS_DIR = process.env.CUMULUS_DIR || path.join(os.homedir(), '.cumulus'); L14: const CONFIG_PATH = path.join(CUMULUS_DIR, 'gateway.config.json'); ... L17: '.git', L18: 'package.json', L19: 'Cargo.toml', ... L70: const readline = await import('readline'); L71: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L72: const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/gateway/setup.jsView on unpkg · L7

7*/ L8: import { execSync } from 'child_process'; L9: import { randomBytes } from 'crypto'; ... L12: import * as path from 'path'; L13: const CUMULUS_DIR = process.env.CUMULUS_DIR || path.join(os.homedir(), '.cumulus'); L14: const CONFIG_PATH = path.join(CUMULUS_DIR, 'gateway.config.json'); ... L17: '.git', L18: 'package.json', L19: 'Cargo.toml', ... L70: const readline = await import('readline'); L71: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L72: const prompt = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/gateway/setup.jsView on unpkg · L7

dist/lib/version-check.jsView file

Lines 159-199javascript

159export function saveUpdateState(from, to) {

160 const state = {

161 previousVersion: from,

162 updatedAt: new Date().toISOString

Source & flagged code

7 flagged · loading source

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @luckydraw/cumulus@0.31.56 matchedIdentity = npm:QGx1Y2t5ZHJhdy9jdW11bHVz:0.31.56 similarity = 0.882 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/gateway.jsView on unpkg

1794// Windows: spawn() can't directly exec .cmd/.bat shims (CVE-2024-27980). L1795: // Routing through cmd.exe is required for the npm-installed `claude.cmd`. L1796: const isWindowsShim = process.platform === 'win32' && /\.(cmd|bat|ps1)$/i.test(resolvedClaudePath);

Findings

1 Critical4 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/lib/gateway.js

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/gateway/server.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @luckydraw/cumulus@0.31.61.

See all versions of @luckydraw/cumulus for other recorded verdicts.

Review the evidence and your use of @luckydraw/cumulus@0.31.61 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-04 09:21:50.593Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.