registry / @mulmoclaude/core / 5.12.0

@mulmoclaude/core@5.12.0

⚠ Under review

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The inspected Google and skill bridge excerpts support ordinary package behavior, and the manifest has no install hook. Static analysis reports unresolved parse and trigger coverage gaps, so the full package cannot be cleared from the available source review.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

No malicious trigger was confirmed in the inspected source.

Impact

The inspected behavior does not establish an attack; incomplete analysis prevents a clean determination.

Mechanism

The reviewed Google excerpts concern calendar sync state, and the reviewed skill excerpts concern project skill handling.

AI rationale

Decision evidence

public snapshot

AI called this Manual Review at 68.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest lists build, typecheck, test, and lint scripts and no install lifecycle hook.
The inspected Google code stores calendar sync tokens and shadow event state under workspace calendar data paths.
The inspected skill bridge uses project skill directories and validates skill slugs; the cited registry and server locations describe reading and importing those project skills.
Static analysis reports parse errors in promptSafety-CKmqbSTK.cjs and an incomplete manifest trigger analysis, leaving package behavior unresolved.

Evidence against

The inspected excerpts do not establish credential transfer, an unrequested account action, or install-time mutation of an agent control surface.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Source & flagged code

14 flagged

dist/discovery-BTl21_hI.jsView file

Lines 1427-1467javascript

1427}

1428/** Return a path DuckDB can read as UTF-8: the original file when it

1429* already is UTF-8 (the cheap, common case — only the head is sniffed),

1430* else a decoded cache copy (see `decodeToCache`). Returns null when

1431* there is no readable file (missing, symlink, or containment-refused —

1432* see `safeCsvStat`), which callers render as an empty collection. */

1433async function ensureUtf8CsvPath(absPath, workspaceRoot) {

1434 const info = await safeCsvStat(absPath, workspaceRoot);

1435 if (info === null) return null;

1436 const head = await readHead(absPath, SNIFF_BYTES);

1437 const sample = head.length === SNIFF_BYTES ? head.subarray(0, 1048573) : head;

1438 if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254

1439 return decodeToCache(absPath, info);

1440}

1441var instancePromise = null;

1442/** Lazily create one shared in-memory DuckDB instance. The dynamic import

1443* keeps the native module OUT of core's load path — a platform where the

1444* prebuilt binding is missing degrades to a per-query error on dataSource

1445* collections only, never a broken core. A failed init is retried on the

1446* next call (the promise is reset). */

1447async function duckDbInstance() {

1448 if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));

1449 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-BTl21_hI.jsView on unpkg · L1447

1450 return await instancePromise;

1451 } catch (err) {

1452 instancePromise = null;

1453 throw new BackendUnavailableError(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);

1454 }

1455}

1456async function queryCsv(sql, params) {

1457 const connection = await (await duckDbInstance()).connect();

1458 try {

1459 return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();

1460 } finally {

1461 connection.disconnectSync();

1462 }

1463}

1464async function csvList(absPath, primaryKey, workspaceRoot) {

1465 const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());

1466 if (utf8Path === null) return {

1467 items: [],

dist/skill-bridge/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js"; import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs"; import path from "node:path"; var data_skills_dir = path.join("data", "skills"); var claude_skills_dir = path.join(".claude", "skills"); var sk[redacted] = "skill.md"; var schema_filename = "schema.json"; var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/; var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/; var recursive_flag_re = /[rr]/; function dataskilldir(workspaceroot, slug) {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/skill-bridge/index.jsView on unpkg

dist/promptSafety-CKmqbSTK.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/promptSafety-CKmqbSTK.cjs#virtual:normalized:round1View on unpkg

dist/google/index.cjsView file

•matchType = normalized_sha256 matchedPackage = @mulmoclaude/core@5.11.4 matchedPath = dist/google/index.cjs matchedIdentity = npm:QG11bG1vY2xhdWRlL2NvcmU:5.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High