registry / @mulmoclaude/core / 5.12.1

@mulmoclaude/core@5.12.1

Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./artifacts, ./whisper/client, ./workspace-setup/slug,

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The manifest has no install hook, and source review traced the flagged Google behavior to collection-scoped calendar synchronization and a Google OAuth flow. Static similarity signals did not correspond to a concrete attack in the inspected source.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

The reviewed functions run when the host invokes Google account or calendar features.

Impact

No malicious effect was established from the inspected behavior.

Mechanism

Calendar pushes use the configured collection mapping, and deletion propagation requires an explicit collection option; login uses a configured HTTPS broker and Google consent page.

AI rationale

Evidence

package.jsondist/skill-bridge/index.jsdist/google/index.cjs

Network endpoints2

asia-northeast1-mulmoserver.cloudfunctions.netaccounts.google.com

Decision evidence

public snapshot

AI called this Clean at 82.0% confidence as Benign with high false-positive risk.

Evidence for AI clean decision

package.json defines build, typecheck, test, and lint scripts; it has no install lifecycle hook.
The skill bridge mirrors allowlisted files from the workspace skill staging directory into that workspace’s Claude skills directory.
Google calendar code keeps local sync state and pushes mapped collection records; it propagates deletions only when the collection enables that option.
Google login uses the package’s configured HTTPS broker and checks that the returned authorization page is Google’s consent page.
The flagged compiled files and inspected dependencies show module imports and ordinary utility, markdown, and Google authentication code; no concrete attack chain was found.

Evidence against

Static similarity alerts identify matching source files but do not establish malicious behavior in the inspected source.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

Source & flagged code

14 flagged

dist/discovery-CbwHtcwk.jsView file

Lines 1427-1467javascript

1427}

1428/** Return a path DuckDB can read as UTF-8: the original file when it

1429* already is UTF-8 (the cheap, common case — only the head is sniffed),

1430* else a decoded cache copy (see `decodeToCache`). Returns null when

1431* there is no readable file (missing, symlink, or containment-refused —

1432* see `safeCsvStat`), which callers render as an empty collection. */

1433async function ensureUtf8CsvPath(absPath, workspaceRoot) {

1434 const info = await safeCsvStat(absPath, workspaceRoot);

1435 if (info === null) return null;

1436 const head = await readHead(absPath, SNIFF_BYTES);

1437 const sample = head.length === SNIFF_BYTES ? head.subarray(0, 1048573) : head;

1438 if (!(head.length >= 2 && (head[0] === 255 && head[1] === 254 || head[0] === 254

1439 return decodeToCache(absPath, info);

1440}

1441var instancePromise = null;

1442/** Lazily create one shared in-memory DuckDB instance. The dynamic import

1443* keeps the native module OUT of core's load path — a platform where the

1444* prebuilt binding is missing degrades to a per-query error on dataSource

1445* collections only, never a broken core. A failed init is retried on the

1446* next call (the promise is reset). */

1447async function duckDbInstance() {

1448 if (instancePromise === null) instancePromise = import("@duckdb/node-api").then((mod) => mod.DuckDBInstance.create(":memory:"));

1449 try {

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/discovery-CbwHtcwk.jsView on unpkg · L1447

1450 return await instancePromise;

1451 } catch (err) {

1452 instancePromise = null;

1453 throw new BackendUnavailableError(`DuckDB is unavailable on this host (@duckdb/node-api failed to load: ${String(err)}) — dataSource collections cannot be read`);

1454 }

1455}

1456async function queryCsv(sql, params) {

1457 const connection = await (await duckDbInstance()).connect();

1458 try {

1459 return (await connection.runAndReadAll(sql, params)).getRowObjectsJS();

1460 } finally {

1461 connection.disconnectSync();

1462 }

1463}

1464async function csvList(absPath, primaryKey, workspaceRoot) {

1465 const utf8Path = await ensureUtf8CsvPath(absPath, workspaceRoot ?? getWorkspaceRoot());

1466 if (utf8Path === null) return {

1467 items: [],

dist/skill-bridge/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { t as issafeactiontemplatepath } from "../templatepath-k_wnbl_q.js"; import { mkdirsync, readfilesync, renamesync, rmsync, writefilesync } from "node:fs"; import path from "node:path"; var data_skills_dir = path.join("data", "skills"); var claude_skills_dir = path.join(".claude", "skills"); var sk[redacted] = "skill.md"; var schema_filename = "schema.json"; var slug_re = /^[a-z0-9]+(-[a-z0-9]+)*$/; var rm_re = /^\s*rm\s+((?:-[a-za-z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/; var recursive_flag_re = /[rr]/; function dataskilldir(workspaceroot, slug) {

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/skill-bridge/index.jsView on unpkg

dist/promptSafety-yET9jLep.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/promptSafety-yET9jLep.cjs#virtual:normalized:round1View on unpkg

dist/google/index.cjsView file

•matchType = normalized_sha256 matchedPackage = @mulmoclaude/core@5.11.4 matchedPath = dist/google/index.cjs matchedIdentity = npm:QG11bG1vY2xhdWRlL2NvcmU:5.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High