@mulmoclaude/core
Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,
This report shows the evidence for @mulmoclaude/core@5.11.4. 1 of 65 known versions is blocked or flagged. The newest version, 5.12.1, is allowed. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiImported registry schemas retain publisher-selected calendar settings, and the scheduled sync automatically pushes records when automatic push is enabled. Because the package performs those writes through the linked Google account without a separate consent gate, this is a concrete unrequested account-action path.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller imports a registry collection with automatic push enabled, and the consuming host runs the scheduled sync while a Google account is linked.
Impact
A registry publisher can cause local records to be added to or changed in a user's Google Calendar without specific consent for those account actions.
Mechanism
The importer preserves the registry schema's calendar settings. The sync uses its calendar identifier and field mapping to create or update events through the linked account.
Attack narrative
A registry import preserves publisher-supplied Google Calendar settings, including automatic push. If the host runs the scheduled sync with a linked account, the package pushes mapped records to the calendar selected by that schema. This creates an account-action path controlled by imported content without a separate confirmation.
AI rationale
Imported registry schemas retain publisher-selected calendar settings, and the scheduled sync automatically pushes records when automatic push is enabled. Because the package performs those writes through the linked Google account without a separate consent gate, this is a concrete unrequested account-action path.
Evidence
dist/collection/registry/server/index.jsdist/discovery-CbwHtcwk.jsdist/google/index.cjsdata/skills/<slug>/schema.json
Network endpoints1
www.googleapis.com/calendar/v3
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The registry importer fetches remote bundles, validates their schema, preserves parsed fields while normalizing the data path, and writes the resulting schema into the imported collection.
- The Google Calendar schema accepts an automatic-push setting; the sync path invokes a push when that setting is enabled, and the package exposes a scheduled task that runs the sync.
- The push uses the schema-selected calendar and linked Google account, then creates or updates calendar events through Google Calendar API requests.
Evidence against
- This requires a registry import and a consuming host to run the scheduled task; package.json shows no npm install lifecycle hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flagged · loading sourcedist/discovery-CbwHtcwk.jsView file
1447package = @mulmoclaude/core; repositoryIdentity = mulmoclaude; dependency = @duckdb/node-api
L1447: async function duckDbInstance() {
L1448: if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));
L1449: try {
High
Copied Package Dependency Bridge
Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.
dist/discovery-CbwHtcwk.jsView on unpkg · L1447dist/skill-bridge/index.jsView file
•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation.
import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js";
import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs";
import path from "node:path";
var data_skills_dir = path.join("data", "skills");
var claude_skills_dir = path.join(".claude", "skills");
var sk[redacted] = "skill.md";
var schema_filename = "schema.json";
var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/;
var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/;
var recursive_flag_re = /[rr]/;
function dataskilldir(workspaceroot, slug) {
Findings
4 High3 Medium5 Low
HighCopied Package Dependency Bridgedist/discovery-CbwHtcwk.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/skill-bridge/index.js
HighSemantic Analysis Limiteddist/promptSafety-yET9jLep.cjs#virtual:normalized:round1
HighAi Review Evidencedist/collection/registry/server/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @mulmoclaude/core@5.11.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mulmoclaude/core@5.11.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.