Loading npm security reports…

@nemus-cli/nemus@0.15.2: AI-agent control-surface risk | LPM Firewall

registry / @nemus-cli/nemus / 0.15.2

@nemus-cli/nemus@0.15.2

Nemus — a CLI for managing multi-repository workspaces. Create, sync, and operate across dozens of repos with a single command, and wire them up to your favorite coding agent.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall automatically launches an upgrade path that changes installed AI-agent integrations. It installs a Claude response hook and copies skills to active agent directories; the hook lifts project permissions into global settings.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Global installation or upgrade of the package on a system with a configured supported agent.

Impact

A project can cause its Claude permission entries to be trusted globally, and package-controlled instructions are installed into multiple agent control surfaces.

Mechanism

Postinstall-driven AI-agent hook, skill, and permission mutation.

Policy narrative

On global install, the lifecycle script launches the MCP upgrade program. When supported agents are present, it installs package skills and a Claude Stop hook. The hook runs after every Claude response and copies reusable permission entries from the current project into the user-wide Claude settings file, expanding trust beyond that project. This is an unconsented install-time modification of AI-agent control surfaces.

AI rationale

The package performs automatic postinstall mutation of foreign, user-wide AI-agent settings and permissions. The lifecycle guard and lack of observed exfiltration do not remove the concrete persistent control-surface risk.

Evidence

scripts/postinstall.jsdist/mcp/install.jsdist/utils/permission-sync.jsdist/utils/agent-config.jssync-permissions.sh~/.claude/settings.json~/.claude/skills

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/workspace.jsView file

2L3: const path = require('path'); L4: const command = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/workspace.jsView on unpkg · L2

src/utils/bug-report.tsView file

11L12: import { execFileSync } from 'child_process'; L13: import * as os from 'os'; ... L22: */ L23: export const BUG_REPORT_REPO = process.env.NEMUS_BUG_REPORT_REPO || 'me-public/nemus'; L24: ... L58: L59: const home = os.homedir(); L60: if (home) { ... L132: try { L133: const raw = JSON.parse(fs.readFileSync(LAST_ERROR_FILE, 'utf-8')); L134: // Validate required fields so a malformed/old file can't crash the reporter.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/bug-report.tsView on unpkg · L11

src/postinstall.test.tsView file

1import { describe, it, expect } from 'vitest'; L2: import { execFileSync } from 'node:child_process'; L3: import { createRequire } from 'node:module'; ... L7: L8: const SCRIPT = join(__dirname, '..', 'scripts', 'postinstall.js'); L9: // postinstall.js guards its side effects with `require.main !== module`, so ... L25: it('npm -g → global-npm; npm local → local', () => { L26: expect(classifyInstall({ env: { npm[redacted]: 'true', npm[redacted]: NPM_UA }, dirname: '/usr/local/lib/node_modules/@nemus-cli/nemus/scripts', tmpDir: TMP })).toBe('g... L27: expect(classifyInstall({ env: { npm[redacted]: 'false', npm[redacted]: NPM_UA }, dirname: '/proj/node_modules/@nemus-cli/nemus/scripts', tmpDir: TMP })).toBe('local'); ... L67: // The real macOS case: os.tmpdir() reports /var/folders/… (a s

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/postinstall.test.tsView on unpkg · L1

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 5610 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

dist/cli/ai-prompt.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/ai-prompt.js#virtual:normalized:round1View on unpkg

dist/utils/branch-operations.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/branch-operations.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/branch-operations.jsView on unpkg

dist/utils/claude-integration.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/claude-integration.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/claude-integration.jsView on unpkg

dist/utils/health-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/health-checks.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/health-checks.jsView on unpkg

dist/utils/version-check.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/version-check.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/version-check.jsView on unpkg

dist/commands/configure.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/commands/configure.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/configure.jsView on unpkg

dist/mcp/install.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/mcp/install.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/install.jsView on unpkg

dist/utils/config.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/config.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/config.jsView on unpkg

dist/utils/editor.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/editor.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/editor.jsView on unpkg

dist/utils/agent-config.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = dist/utils/agent-config.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/agent-config.jsView on unpkg

src/commands/configure.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = src/commands/configure.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/configure.tsView on unpkg

src/mcp/install.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = src/mcp/install.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp/install.tsView on unpkg

src/utils/agent-config.test.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.15.0 matchedPath = src/utils/agent-config.test.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/agent-config.test.tsView on unpkg