registry / @nemus-cli/nemus / 0.4.0

@nemus-cli/nemus@0.4.0

Nemus — a CLI for managing multi-repository workspaces. Create, sync, and operate across dozens of repos with a single command, and wire them up to your favorite coding agent.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the postinstall script launches an agent-upgrade routine. That routine can add persistent Claude command hooks and skills, install Pi extensions, and alter agent context and MCP files across existing workspaces.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing or upgrading the package through npm.

Impact

A package installation can persist package-controlled commands in AI-agent control surfaces and change existing workspace instructions without a separate user command.

Mechanism

Automatic lifecycle-driven mutation of AI-agent settings, skills, hooks, and workspace context.

Policy narrative

npm runs scripts/postinstall.js automatically. It launches dist/mcp/install.js upgrade, which installs Claude hooks and status-line commands, copies skills into active agent directories, installs Pi extensions, backfills MCP files, and edits agent context in existing workspaces. These actions modify broad, foreign AI-agent control surfaces during installation rather than after an explicit setup command.

Rationale

The automatic postinstall path mutates persistent AI-agent configuration and existing workspace control files. This is concrete unconsented install-time control-surface mutation, so it meets the blocking policy despite no observed secret exfiltration.

Evidence

package.jsonscripts/postinstall.jssrc/mcp/install.tssrc/utils/permission-sync.tssrc/utils/claude-integration.tssync-permissions.sh~/.claude/settings.json~/.claude/skills/*~/.pi/agent/skills/*existing-workspace/AGENTS.mdexisting-workspace/CLAUDE.mdexisting-workspace/.mcp.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The npm postinstall hook automatically runs the package installer.
That installer automatically runs an MCP upgrade during installation.
The upgrade installs Claude hooks, agent skills, and Pi extensions.
It writes a command hook into the user's Claude settings.
It also modifies existing workspace agent context files and MCP configuration.

Evidence against

No source evidence of credential theft or direct data exfiltration was found.
The mutations are package-branded and partly conditional on detected agent configuration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 242 file(s), 1.54 MB of source, external domains: claude.ai, github.com

Source & flagged code

18 flagged

package.jsonView file

Lines 47-87json

47 "skills/**/*.md",

48 "uninstall.sh",

49 "assets/**/*",

50 "README.md",

51 "LICENSE",

52 "CHANGELOG.md",

53 "tsconfig.json"

54 ],

55 "bin": {

56 "nemus": "bin/workspace.js",

57 "nem": "bin/workspace.js",

58 "nemus-mcp": "dist/mcp/server.js"

59 },

60 "scripts": {

61 "test": "vitest run",

62 "test:watch": "vitest",

63 "build": "tsc && cp src/commands/dashboard/sidebar.js dist/commands/dashboard/sidebar.js && rm -rf dist/pi-extensions && cp -r src/pi-extensions dist/pi-extensions && rm -rf dist/scripts && cp -r src/scripts dist/scripts",

64 "clean": "rm -rf dist",

65 "typecheck": "tsc --noEmit",

66 "prepublishOnly": "npm run clean && npm run build",

67 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L67

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L67

68 },

69 "dependencies": {

70 "@modelcontextprotocol/sdk": "^1.26.0",

71 "cli-progress": "^3.12.0",

72 "commander": "^15.0.0",

73 "fuzzy": "^0.1.3",

74 "ink": "^7.1.1",

75 "inquirer": "^8.0.0",

76 "inquirer-autocomplete-prompt": "^2.0.0",

77 "markdown-table": "^3.0.3",

78 "react": "^19.2.8",

79 "zod": "^4.3.6"

80 },

81 "devDependencies": {

82 "@types/cli-progress": "^3.11.0",

83 "@types/inquirer": "^9.0.3",

84 "@types/inquirer-autocomplete-prompt": "^2.0.0",

85 "@types/node": "^26.3.0",

86 "@types/react": "^19.2.2",

87 "ts-node": "^10.9.1",

bin/workspace.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const path = require('path');

4const command = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/workspace.jsView on unpkg · L2

src/utils/bug-report.tsView file

Lines 1-31typescript

1/**

2 * Bug reporting — capture runtime errors and file them as GitHub issues

3 * against the project repo.

4 *

5 * Design goals (see PR discussion):

6 * - Sanitize: never leak home dir, usernames, emails, or token-like strings.

7 * - Deduplicate: one issue per distinct error signature (search before create).

8 * - Safe: only file genuine tool errors; skip clearly-environmental ones unless

9 * forced. Auto-filing is opt-in via config (autoReportBugs).

10 */

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 4891 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

dist/cli/ai-prompt.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/ai-prompt.js#virtual:normalized:round1View on unpkg

dist/commands/configure.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/commands/configure.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/configure.jsView on unpkg

dist/utils/branch-operations.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/branch-operations.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/branch-operations.jsView on unpkg

dist/utils/claude-integration.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/claude-integration.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/claude-integration.jsView on unpkg

dist/utils/ghq-integration.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/ghq-integration.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/ghq-integration.jsView on unpkg

dist/utils/health-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/health-checks.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/health-checks.jsView on unpkg

dist/mcp/install.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/mcp/install.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/install.jsView on unpkg

dist/utils/bug-report.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/bug-report.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/bug-report.jsView on unpkg

dist/utils/agent-config.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/agent-config.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/agent-config.jsView on unpkg

dist/utils/config.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = dist/utils/config.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/config.jsView on unpkg

src/commands/configure.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = src/commands/configure.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/configure.tsView on unpkg

src/mcp/install.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = src/mcp/install.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp/install.tsView on unpkg

src/utils/agent-config.test.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.2.10 matchedPath = src/utils/agent-config.test.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.2.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/agent-config.test.tsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/workspace.jsView file

2L3: const path = require('path'); L4: const command = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/workspace.jsView on unpkg · L2

src/utils/bug-report.tsView file

11L12: import { execFileSync } from 'child_process'; L13: import * as os from 'os'; ... L22: */ L23: export const BUG_REPORT_REPO = process.env.NEMUS_BUG_REPORT_REPO || 'me-public/nemus'; L24: ... L58: L59: const home = os.homedir(); L60: if (home) { ... L132: try { L133: const raw = JSON.parse(fs.readFileSync(LAST_ERROR_FILE, 'utf-8')); L134: // Validate required fields so a malformed/old file can't crash the reporter.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/bug-report.tsView on unpkg · L11

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 4891 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

dist/cli/ai-prompt.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/ai-prompt.js#virtual:normalized:round1View on unpkg

dist/commands/configure.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/configure.jsView on unpkg

dist/utils/branch-operations.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/branch-operations.jsView on unpkg

dist/utils/claude-integration.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/claude-integration.jsView on unpkg

dist/utils/ghq-integration.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/ghq-integration.jsView on unpkg

dist/utils/health-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/health-checks.jsView on unpkg

dist/mcp/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/install.jsView on unpkg

dist/utils/bug-report.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/bug-report.jsView on unpkg

dist/utils/agent-config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/agent-config.jsView on unpkg

dist/utils/config.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/config.jsView on unpkg

src/commands/configure.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/configure.tsView on unpkg

src/mcp/install.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp/install.tsView on unpkg

src/utils/agent-config.test.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/agent-config.test.tsView on unpkg

Findings

14 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limiteddist/cli/ai-prompt.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/configure.js

HighKnown Malware Source Similaritydist/utils/branch-operations.js

HighKnown Malware Source Similaritydist/utils/claude-integration.js

HighKnown Malware Source Similaritydist/utils/ghq-integration.js

HighKnown Malware Source Similaritydist/utils/health-checks.js

HighKnown Malware Source Similaritydist/mcp/install.js

HighKnown Malware Source Similaritydist/utils/bug-report.js

HighKnown Malware Source Similaritydist/utils/agent-config.js

HighKnown Malware Source Similaritydist/utils/config.js

HighKnown Malware Source Similaritysrc/commands/configure.ts

HighKnown Malware Source Similaritysrc/mcp/install.ts

HighKnown Malware Source Similaritysrc/utils/agent-config.test.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/workspace.js

MediumEnvironment Vars

MediumShips Build Helperuninstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/utils/bug-report.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings