registry / @mulmoclaude/core / 0.5.1

@mulmoclaude/core@0.5.1

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./whisper/client, ./workspace-setup/slug and ./transla

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Static inspection found risky primitives, but they implement documented server-side features with validation and require host/user invocation. There is no install-time/import-time execution, credential collection, hidden exfiltration, or unconsented AI-agent control-surface mutation.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Host application calls exported feed, registry import, workspace setup, whisper, or collection APIs.

Impact

Expected workspace collection/feed/skill synchronization and transcription behavior; no credential harvesting, exfiltration, persistence, or unconsented agent control mutation identified.

Mechanism

User/host-invoked feed fetching, model download, local transcription sidecar, and skill/collection file management.

AI rationale

Evidence

package.jsondist/feeds/server/index.cjsdist/whisper/index.cjsdist/collection/registry/server/index.cjsdist/workspace-setup/index.jsdist/skill-bridge/index.cjsdist/server-cmnH6g2O.cjsworkspace data/feeds/<slug>workspace feeds/<slug>modelsDir/.scratch/utterance-*.webmmodelsDir/.scratch/utterance-*.wavmodelsDir/ggml-*.binworkspace data/skills/<slug>workspace .claude/skills/<slug>workspace data/collections/<slug>/itemsworkspace config/scheduler/state.jsonworkspace data/scheduler/logs

Network endpoints6

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks or bin entrypoint.
dist/feeds/server/index.cjs fetches configured feed URLs only during refresh and blocks private/loopback DNS/IPs.
dist/whisper/index.cjs downloads known Whisper models from Hugging Face and spawns user-configured ffmpeg/whisper-server only via exported transcription APIs.
dist/collection/registry/server/index.cjs fetches collection registries from official/user-configured HTTPS URLs and validates bundle paths before writing.
dist/skill-bridge/index.cjs mirrors allowlisted skill files into workspace .claude/skills only from explicit workspace/import flows, not at install/import time.
Destructive file operations are scoped by slug/path validation and workspace containment checks in inspected files.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

1 flagged

dist/feeds/server/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mulmoclaude/core@0.5.0 matchedIdentity = npm:QG11bG1vY2xhdWRlL2NvcmU:0.5.0 similarity = 0.891 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/feeds/server/index.cjsView on unpkg

Source & flagged code

1 flagged · loading source

dist/feeds/server/index.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/feeds/server/index.cjsView on unpkg

Findings

1 Critical3 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/feeds/server/index.cjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mulmoclaude/core@0.5.1.

See all versions of @mulmoclaude/core for other recorded verdicts.

Review the evidence and your use of @mulmoclaude/core@0.5.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-01 07:21:19.663Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.