registry / @luckydraw/cumulus / 1.0.30

@luckydraw/cumulus@1.0.30

RLM-based CLI chat wrapper for Claude with external history context management

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The scanner flags point to normal Cumulus features: Claude subprocess use, message routing, optional service setup, and explicit package updates. The inspected source did not establish malicious behavior or an unresolved attack surface.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Package installation runs its prepare hook; service setup, gateway actions, and updates occur through their respective user or configured triggers.

Impact

These operations can start the configured gateway, process thread messages, or update the package; inspected source did not establish unrelated credential disclosure or unrequested account changes.

Mechanism

The prepare hook runs Husky, interactive setup can offer service installation, and the updater installs a selected Cumulus version. Runtime callers pass messages into configured threads and integrations.

AI rationale

Evidence

package.jsondist/lib/content-detector.jsdist/lib/gateway.jsdist/gateway/server.jsdist/gateway/setup.jsdist/lib/version-check.js

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json runs Husky in its prepare hook and lists dependencies without a runtime dependency on itself.
Content analysis runs the Claude CLI with a prompt sent through standard input and filters Claude-related environment variables.
The inspected runtime operations format thread messages, collect context, and manage tool and worktree state.
Gateway callers pass messages from users, configured chat adapters, webhooks, scheduled triggers, and queued jobs into thread processing.
The gateway agent MCP entry is omitted unless gateway configuration is supplied; its API URL and key come from that configuration.
Service installation asks for interactive confirmation, and the updater installs a selected version of this package when invoked.

Evidence against

The package uses child processes, webhooks, chat adapters, scheduled agent triggers, and an npm updater; inspected code ties these to its gateway and CLI functions.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystem

Source & flagged code

8 flagged

dist/tui/hooks/useClaudeProcess.jsView file

Lines 1-23javascript

1/**

2 * Hook for managing Claude subprocess and streaming.

3 */

4import { spawn } from 'child_process';

5import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

6import { ContextBudget } from '../../lib/context-budget.js';

7import { StreamProcessor } from '../../lib/stream-processor.js';

8import { extractTextFromStreamLine } from '../utils/streamParser.js';

9export function useClaudeProcess(options) {

10 const { mcpConfigPath, contentStore, onText, onComplete, onError, onExternalize, onTTFT } = options;

11 const processRef = useRef(null);

12 const responseRef = useRef('');

13 const bufferRef = useRef('');

14 const completedRef = useRef(false);

15 const spawnTimeRef = useRef(0);

16 const ttftFiredRef = useRef(false);

17 const kill = useCallback(() => {

18 const partial = responseRef.current;

19 if (processRef.current) {

20 processRef.current.kill('SIGTERM');

21 processRef.current = null;

22 }

23 return partial;

dist/lib/gateway.jsView file

Lines 2088-2128javascript

2088 // under --permission-mode bypassPermissions it is a guaranteed no-op — so deny-by-default

2089 // has to be expressed as a denylist. Gated on the field being present so an unconstrained

2090 // thread never pays for the inventory probe (a subprocess spawn) at all.

2091 const effectiveDisallowedTools = mergedConfig.allowedTools

2092 ? compileDisallowedTools(mergedConfig.allowedTools, await

dist/gateway/server.jsView file

Lines 1-36javascript

1/**

2 * Gateway HTTP server — exposes the cumulus message pipeline as a REST API

3 * with SSE streaming. Channel adapters and remote clients connect here.

4 *

5 * Endpoints:

6 * POST /api/thread/:name/message — submit message, SSE stream response

7 * POST /api/thread/:name/sync — sync messages from local mode (store only, no Claude)

8 * GET /api/thread/:name/history — recent messages

9 * GET /api/thread/:name/status — thread info + adaptive state

10 * GET /api/threads — list all threads

dist/gateway/setup.jsView file

Lines 1-27javascript

1/**

2 * cumulus-gateway setup wizard and config management.

3 *

4 * Phase 1: `cumulus-gateway setup --project-root <path>` — instant non-interactive setup

5 * Phase 2: `cumulus-gateway setup` — interactive prompts with auto-detection

6 * Phase 4: `cumulus-gateway config set/get/list` — post-install config changes

7 */

8import { execSync } from 'child_process';

9import

dist/lib/version-check.jsView file

Lines 159-199javascript

159export function saveUpdateState(from, to) {

160 const state = {

161 previousVersion: from,

162 updatedAt: new Date().toISOString

dist/gateway/daemon.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/gateway/daemon.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @luckydraw/cumulus@1.0.4 matchedIdentity = npm:QGx1Y2t5ZHJhdy9jdW11bHVz:1.0.4 similarity = 0.752 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/gateway.jsView on unpkg

2108// Windows: spawn() can't directly exec .cmd/.bat shims (CVE-2024-27980). L2109: // Routing through cmd.exe is required for the npm-installed `claude.cmd`. L2110: const isWindowsShim = process.platform === 'win32' && /\.(cmd|bat|ps1)$/i.test(resolvedClaudePath);

Findings

1 Critical5 High4 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/lib/gateway.js

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

HighSemantic Analysis Limiteddist/gateway/daemon.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/gateway/server.js

Affected versions and remediation

This report applies to @luckydraw/cumulus@1.0.30.

See all versions of @luckydraw/cumulus for other recorded verdicts.

Review the evidence and your use of @luckydraw/cumulus@1.0.30 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 10:43:44.017Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.