registry / AI-agent capability abuse / @luckydraw/cumulus / 1.0.69

@luckydraw/cumulus@1.0.69

RLM-based CLI chat wrapper for Claude with external history context management

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Source inspection found a guarded visitor capability that uses the user’s Codex authentication, which warrants a warning under the agent capability policy. The inspected source does not show a concrete malicious credential exfiltration path or malicious install behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A gateway operation that invokes the configured isolated visitor.

Impact

The feature uses the user’s Codex session for the visitor operation; no confirmed attack was identified.

Mechanism

The visitor copies the existing Codex auth file into a private temporary home for Codex; an optional test provider is limited to loopback, and the visitor uses an allowlisted MCP service and tool.

AI rationale

Evidence

dist/lib/restricted-codex.jsdist/lib/gateway.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The gateway can invoke an isolated Codex visitor that copies the user’s Codex auth file into a temporary home.
The visitor also accepts an explicit test provider, but its base URL is restricted to loopback.
The package postinstall invokes a package-local GPU-provider cleanup script; this does not establish malicious install behavior.

Evidence against

The visitor validates a pinned model and allows only the fidas_call tool; it checks that the connected service exposes exactly the configured tool allowlist.
The visitor’s alternate provider path enforces a loopback URL, and the default path uses the Codex CLI’s existing auth file.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetry

Source & flagged code

9 flagged

package.jsonView file

Lines 31-71json

31 "scripts/strip-gpu-providers.mjs",

32 "package.json",

33 "CHANGELOG.md"

34 ],

35 "bin": {

36 "cumulus": "./dist/cli/cumulus.js",

37 "cumulus-mcp": "./dist/mcp/index.js",

38 "cumulus-gateway": "./dist/gateway/daemon.js"

39 },

40 "scripts": {

41 "build": "rm -rf dist && tsc && cp -r src/gateway/static dist/gateway/static && cp node_modules/@luckydraw/blex/dist/blex.min.global.js dist/gateway/static/blex.min.js && cp node_modules/@luckydraw/blex/dist/blex-chart.min.global.js dist/gateway/static/blex-chart.min.js && node scripts/build-mermaid-esm.mjs && node scripts/check-bundled-dompurify.mjs",

42 "dev": "tsc --watch",

43 "lint": "eslint src",

44 "lint:fix": "eslint src --fix",

45 "format": "prettier --write \"src/**/*.{ts,tsx,json,md}\"",

46 "format:check": "prettier --check \"src/**/*.{ts,tsx,json,md}\"",

47 "type-check": "tsc --noEmit",

48 "test": "vitest",

49 "version": "bash scripts/generate-changelog.sh || true",

50 "prepublishOnly": "npm run build && npm run type-check",

51 "postinstall": "node scripts/strip-gpu-providers.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

52 "prepare": "husky"

53 },

54 "keywords": [

55 "claude",

56 "cli",

57 "chat",

58 "rlm",

59 "context",

60 "mcp"

61 ],

62 "author": "Lucky Draw LLC",

63 "license": "SEE LICENSE IN LICENSE",

64 "publishConfig": {

65 "access": "public"

66 },

67 "engines": {

68 "node": ">=20.0.0"

69 },

70 "lint-staged": {

71 "*.{ts,tsx}": [

dist/tui/hooks/useClaudeProcess.jsView file

Lines 1-23javascript

1/**

2 * Hook for managing Claude subprocess and streaming.

3 */

4import { spawn } from 'child_process';

5import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

Lines 2555-2595javascript

2555 // under --permission-mode bypassPermissions it is a guaranteed no-op — so deny-by-default

2556 // has to be expressed as a denylist. Gated on the field being present so an unconstrained

2557 // thread never pays for the inventory probe (a subprocess spawn) at all.

2558 const effectiveDisallowedTools = mergedConfig.allowedTools

2559 ? compileDisallowedTools(mergedConfig.allowedTools, await

dist/gateway/server.jsView file

Lines 1-31javascript

1/**

2 * Gateway HTTP server — exposes the cumulus message pipeline as a REST API

3 * with SSE streaming. Channel adapters and remote clients connect here.

4 *

5 * Endpoints:

6 * POST /api/thread/:name/message — submit message, SSE stream response

7 * POST /api/thread/:name/sync — sync messages from local mode (store only, no Claude)

8 * GET /api/thread/:name/history — recent messages

9 * GET /api/thread/:name/status — thread info + adaptive state

10 * GET /api/threads — list all threads

dist/gateway/setup.jsView file

Lines 1-27javascript

1/**

2 * cumulus-gateway setup wizard and config management.

3 *

4 * Phase 1: `cumulus-gateway setup --project-root <path>` — instant non-interactive setup

5 * Phase 2: `cumulus-gateway setup` — interactive prompts with auto-detection

6 * Phase 4: `cumulus-gateway config set/get/list` — post-install config changes

7 */

8import { execSync } from 'child_process';

9import

dist/lib/version-check.jsView file

Lines 159-199javascript

159export function saveUpdateState(from, to) {

160 const state = {

161 previousVersion: from,

162 updatedAt: new Date().toISOString

dist/gateway/daemon.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/gateway/daemon.js#virtual:normalized:round1View on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/strip-gpu-providers.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/tui/hooks/useClaudeProcess.jsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { useCallback, useRef } from 'react';

High

Child Process

Package source references child process execution.

dist/tui/hooks/useClaudeProcess.jsView on unpkg · L3

dist/lib/gateway.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @luckydraw/cumulus@1.0.4 matchedIdentity = npm:QGx1Y2t5ZHJhdy9jdW11bHVz:1.0.4 similarity = 0.465 summary = stored previous version shares package body but lacks this dangerous source file

Findings

1 Critical6 High4 Medium9 Low

CriticalPrevious Version Dangerous Deltadist/lib/gateway.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/tui/hooks/useClaudeProcess.js

HighShelldist/lib/gateway.js

HighTrigger Reachable Persistencedist/gateway/setup.js

HighRuntime Package Installdist/lib/version-check.js

HighSemantic Analysis Limiteddist/gateway/daemon.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/gateway/setup.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Affected versions and remediation

This report applies to @luckydraw/cumulus@1.0.69.

See all versions of @luckydraw/cumulus for other recorded verdicts.

Review the evidence and your use of @luckydraw/cumulus@1.0.69 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:58:39.668Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.