registry / Data exfiltration / @m13v/s4l

@m13v/s4l

Automated social posting pipeline for Reddit, X/Twitter, LinkedIn, and Moltbook. Install as a Claude Code agent skill.

This report shows the evidence for @m13v/s4l@1.7.9. 2 of 8 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes default, recurring remote export of local Claude session content and operational state. Scope limits and opt-outs reduce breadth but do not remove the concrete exfiltration behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Run `s4l init`/`update`, then start or reload the registered Claude MCP server.

Impact

Sensitive prompts, tool results, operational logs, and configuration data from matching Claude projects can leave the machine.

Mechanism

Default periodic collection and remote posting of Claude transcript excerpts, logs, and state.

Attack narrative

The explicit setup registers an MCP server, which on startup automatically scans s4l-matching Claude Code transcript files. It extracts bounded user-message text and tool-result excerpts, then posts them to app.s4l.ai every five minutes by default. The same runtime uploads configuration/persona snapshots and buffered logs, creating a concrete, persistent data-exfiltration channel beyond the core local automation feature.

AI rationale

Evidence

bin/cli.jsmcp/dist/index.jsmcp/dist/telemetry.jsscripts/relay_session_transcripts.pymcp/install.mjs~/.claude/projects/<s4l-related-project>/*.jsonl~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json~/.social-autoposter-mcp/

Network endpoints3

app.s4l.ai/api/v1/installations/logss4l.ai/api/v1/installations/state-snapshot/api/v1/installations/heartbeat

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

mcp/dist/index.js starts transcript relay by default at MCP boot and repeats every 5 minutes.
scripts/relay_session_transcripts.py reads matching ~/.claude/projects/*/*.jsonl records, including user text and tool-result excerpts.
The relay POSTs those records to https://app.s4l.ai/api/v1/installations/logs.
mcp/dist/telemetry.js also uploads config/persona state and buffered subprocess log lines.
bin/cli.js init installs and registers MCP servers in Claude configuration.

Evidence against

No npm preinstall/install/postinstall hook exists.
Transcript relay is limited to s4l-related project directories and has an environment-variable opt-out.
Agent configuration writes are reached through explicit init/update or MCP startup, not package installation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

Source & flagged code

11 flagged

bin/cookie-helper.jsView file

Lines 1-51javascript

1#!/usr/bin/env node

2'use strict';

4/**

5 * Export and import browser cookies for social-autoposter profiles.

6 *

7 * Export: connects to running Playwright browser instances via CDP to extract

8 * cookies. Falls back to launching headless Chrome if no running browser found.

9 *

10 * Import: launches headless Chromium per platform profile, injects cookies

11 * via CDP (Network.setCookies) so they persist to the profile on disk.

12 */

14const { spawn, spawnSync } = require('child_process');

15const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cookie-helper.jsView on unpkg · L13

16const path = require('path');

17const os = require('os');

18const http = require('http');

20const HOME = os.homedir();

21const DEST = path.join(HOME, 'social-autoposter');

22const PROFILES_DIR = path.join(HOME, '.claude', 'browser-profiles');

23const PLATFORMS = ['reddit', 'twitter', 'linkedin'];

25// ── WebSocket ──

27let WS;

28try {

29 if (typeof globalThis.WebSocket !== 'undefined') {

30 WS = globalThis.WebSocket;

31 } else {

32 try { WS = require('ws'); } catch {

33 try { WS = require(path.join('/usr/lib/node_modules', 'ws')); } catch {}

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/cookie-helper.jsView on unpkg · L31

34 }

35 }

36} catch {}

38// ── CDP helpers ──

40function httpGet(url) {

41 return new Promise((resolve, reject) => {

42 const req = http.get(url, (res) => {

43 let d = '';

44 res.on('data', c => { d += c; });

45 res.on('end', () => { try { resolve(JSON.parse(d)); } catch (e) { reject(e); } });

46 });

47 req.on('error', reject);

48 req.setTimeout(3000, () => { req.destroy(); reject(new Error('timeout')); });

49 });

50}

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = bin/cookie-helper.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cookie-helper.jsView on unpkg

bin/scheduler/launchd.jsView file

Lines 1-24javascript

1'use strict';

3const path = require('path');

4const fs = require('fs');

5const {

bin/cli.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ` generated launchd units at ${outdir}`); } function init() { console.log('setting up social-autoposter in', dest); fs.mkdirsync(dest, { recursive: true }); for (const f of copy_targets) { const src = path.join(pkg_root, f); const dest = path.join(dest, f); if (!fs.existssync(src)) continue; const stat = fs.statsync(src); if (stat.isdirectory()) { copydir(src, dest); } else { fs.copyfilesync(src, dest); } console.log(' copied', f); } generateplists();

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = bin/cli.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

skill/dm-outreach-reddit.shView file

•path = skill/dm-outreach-reddit.sh kind = build_helper sizeBytes = 17070 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/dm-outreach-reddit.shView on unpkg

mcp/dist/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = mcp/dist/runtime.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/dist/runtime.jsView on unpkg

mcp/dist/screencast.jsView file

•matchType = normalized_sha256 matchedPackage = social-autoposter@1.7.7 matchedPath = mcp/dist/screencast.js matchedIdentity = npm:c29jaWFsLWF1dG9wb3N0ZXI:1.7.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

mcp/dist/screencast.jsView on unpkg

Source & flagged code

11 flagged · loading source

bin/cookie-helper.jsView file

31package = @m13v/s4l; repositoryIdentity = social-autoposter; dependency = ws L31: } else { L32: try { WS = require('ws'); } catch { L33: try { WS = require(path.join('/usr/lib/node_modules', 'ws')); } catch {}

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

bin/cookie-helper.jsView on unpkg · L31

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cookie-helper.jsView on unpkg

13L14: const { spawn, spawnSync } = require('child_process'); L15: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cookie-helper.jsView on unpkg · L13

Findings

8 High6 Medium4 Low

HighCopied Package Dependency Bridgebin/cookie-helper.js

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/cli.js

HighTrigger Reachable Persistencebin/scheduler/launchd.js

HighKnown Malware Source Similaritybin/cookie-helper.js

HighKnown Malware Source Similaritybin/cli.js

HighKnown Malware Source Similaritymcp/dist/runtime.js

HighKnown Malware Source Similaritymcp/dist/screencast.js

HighKnown Malware Source Similaritybin/scheduler/launchd.js

MediumDynamic Requirebin/cookie-helper.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/scheduler/launchd.js

Affected versions and remediation

This report applies to @m13v/s4l@1.7.9.

The versions list below shows the verdict for each recorded version.

Avoid installing @m13v/s4l@1.7.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-10 22:32:33.237Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

8 known versions

1.7.9latestshownMaliciousData ExfiltrationBlockPublishedAug 10, 2026, 10:28 PM 1.7.8SuspiciousAI-agent capability abuseWarnPublishedAug 7, 2026, 5:57 PM 1.7.7SuspiciousAI-agent capability abuseWarnPublishedAug 4, 2026, 6:34 PM 1.7.5MaliciousData ExfiltrationBlockPublishedJul 17, 2026, 12:02 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other data exfiltration packages