registry / AI-agent capability abuse / @luckydraw/cumulus / 1.0.0

@luckydraw/cumulus@1.0.0

RLM-based CLI chat wrapper for Claude with external history context management

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package is a deliberately powerful local agent gateway with unrestricted execution primitives. Its persistence and update paths are explicit user-command setup/update flows, not automatic installation behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User starts cumulus-gateway and submits an authenticated agent request.

Impact

An authorized or compromised gateway client could cause arbitrary local commands, file changes, and network requests.

Mechanism

Claude subprocess with bypassed permissions plus shell, file-write, and web tools

AI rationale

Evidence

package.jsondist/lib/gateway.jsdist/lib/tools/bash.jsdist/lib/tools/write.jsdist/lib/tools/web-fetch.jsdist/gateway/setup.jsdist/gateway/auth.jsdist/gateway/server.js

Network endpoints2

registry.npmjs.org/@luckydraw/cumulus/latestapi.search.brave.com/res/v1/web/search

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/lib/gateway.js starts Claude with --permission-mode bypassPermissions.
dist/lib/tools/bash.js executes arbitrary bash commands.
dist/lib/tools/write.js can create or overwrite arbitrary paths.
dist/lib/tools/web-fetch.js permits arbitrary HTTP methods and URLs.
dist/gateway/server.js exposes these capabilities through an authenticated gateway.

Evidence against

package.json has no preinstall, install, or postinstall hook.
dist/gateway/setup.js installs persistence only after explicit setup and TTY confirmation.
dist/gateway/auth.js requires a configured API key for non-health API routes.
No hidden credential harvesting or unsolicited exfiltration was found in inspected paths.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinified

Source & flagged code

7 flagged

dist/tui/hooks/useClaudeProcess.jsView file

Lines 1-23javascript

1/**

2 * Hook for managing Claude subprocess and streaming.

3 */

4import { spawn } from 'child_process';

5import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

6import { ContextBudget } from '../../lib/context-budget.js';

7import { StreamProcessor } from '../../lib/stream-processor.js';

8import { extractTextFromStreamLine } from '../utils/streamParser.js';

9export function useClaudeProcess(options) {

10 const { mcpConfigPath, contentStore, onText, onComplete, onError, onExternalize, onTTFT } = options;

11 const processRef = useRef(null);

12 const responseRef = useRef('');

13 const bufferRef = useRef('');

14 const completedRef = useRef(false);

15 const spawnTimeRef = useRef(0);

16 const ttftFiredRef = useRef(false);

17 const kill = useCallback(() => {

18 const partial = responseRef.current;

19 if (processRef.current) {

20 processRef.current.kill('SIGTERM');

21 processRef.current = null;

22 }

23 return partial;

dist/lib/gateway.jsView file

Lines 1814-1854javascript

1814 'stream-json',

1815 '--permission-mode',

1816 'bypassPermissions',

1817 '--mcp-config',

1818 mcpConfigPath,

1819 '--strict-mcp-config',

1820 '--input-format'

dist/gateway/server.jsView file

Lines 1-36javascript

1/**

2 * Gateway HTTP server — exposes the cumulus message pipeline as a REST API

3 * with SSE streaming. Channel adapters and remote clients connect here.

4 *

5 * Endpoints:

6 * POST /api/thread/:name/message — submit message, SSE stream response

7 * POST /api/thread/:name/sync — sync messages from local mode (store only, no Claude)

8 * GET /api/thread/:name/history — recent messages

9 * GET /api/thread/:name/status — thread info + adaptive state

10 * GET /api/threads — list all threads

dist/gateway/setup.jsView file

Lines 1-27javascript

1/**

2 * cumulus-gateway setup wizard and config management.

3 *

4 * Phase 1: `cumulus-gateway setup --project-root <path>` — instant non-interactive setup

5 * Phase 2: `cumulus-gateway setup` — interactive prompts with auto-detection

6 * Phase 4: `cumulus-gateway config set/get/list` — post-install config changes

7 */

8import { execSync } from 'child_process';

9import

dist/lib/version-check.jsView file

Lines 159-199javascript

159export function saveUpdateState(from, to) {

160 const state = {

161 previousVersion: from,

162 updatedAt: new Date().toISOString

Source & flagged code

7 flagged · loading source

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

1834// Windows: spawn() can't directly exec .cmd/.bat shims (CVE-2024-27980). L1835: // Routing through cmd.exe is required for the npm-installed `claude.cmd`. L1836: const isWindowsShim = process.platform === 'win32' && /\.(cmd|bat|ps1)$/i.test(resolvedClaudePath);

High

Shell

Package source references shell execution.

dist/lib/gateway.jsView on unpkg · L1834

dist/gateway/server.jsView file

Findings

1 Critical4 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/gateway/setup.js

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/gateway/server.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @luckydraw/cumulus@1.0.0.

See all versions of @luckydraw/cumulus for other recorded verdicts.

Review the evidence and your use of @luckydraw/cumulus@1.0.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-08 20:20:43.684Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.