Loading npm security reports…

@nemus-cli/nemus@0.9.0: AI-agent control-surface risk | LPM Firewall

registry / @nemus-cli/nemus / 0.9.0

@nemus-cli/nemus@0.9.0

Nemus — a CLI for managing multi-repository workspaces. Create, sync, and operate across dozens of repos with a single command, and wire them up to your favorite coding agent.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Npm post-install automatically changes shell startup files and installs an agent hook. The hook executes after Claude responses and merges project-level permissions into the user-wide Claude configuration.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing or upgrading the package with npm; the installed hook then runs after each Claude response.

Impact

A package install can persist command execution and broaden an AI agent's approved permissions without an explicit setup command.

Mechanism

Automatic lifecycle installation of shell code and a Claude Stop hook that promotes project permissions to user-wide settings.

Policy narrative

Installing the package invokes its post-install script. That script writes a large shell integration into the user's shell profile and automatically runs the compiled MCP upgrade routine. The upgrade installs a Claude Stop hook in the user-wide settings file. On every Claude response, that hook reads the current project's local permission settings and merges reusable entries into the global settings file, causing project-provided permissions to become available across workspaces.

Rationale

This is an unconsented post-install mutation of broad shell and AI-agent control surfaces. The persistent hook changes user-wide Claude permissions from project-controlled input, so it meets the install-hook abuse blocking boundary.

Evidence

package.jsonscripts/postinstall.jsinstall-shell-integration.shdist/mcp/install.jsdist/utils/permission-sync.jssync-permissions.sh

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/workspace.jsView file

2L3: const path = require('path'); L4: const command = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/workspace.jsView on unpkg · L2

src/utils/bug-report.tsView file

11L12: import { execFileSync } from 'child_process'; L13: import * as os from 'os'; ... L22: */ L23: export const BUG_REPORT_REPO = process.env.NEMUS_BUG_REPORT_REPO || 'me-public/nemus'; L24: ... L58: L59: const home = os.homedir(); L60: if (home) { ... L132: try { L133: const raw = JSON.parse(fs.readFileSync(LAST_ERROR_FILE, 'utf-8')); L134: // Validate required fields so a malformed/old file can't crash the reporter.

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/utils/bug-report.tsView on unpkg · L11

uninstall.shView file

•path = uninstall.sh kind = build_helper sizeBytes = 4891 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

uninstall.shView on unpkg

dist/cli/ai-prompt.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli/ai-prompt.js#virtual:normalized:round1View on unpkg

dist/commands/configure.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/commands/configure.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/configure.jsView on unpkg

dist/utils/branch-operations.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/utils/branch-operations.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/branch-operations.jsView on unpkg

dist/utils/claude-integration.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/utils/claude-integration.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/claude-integration.jsView on unpkg

dist/utils/ghq-integration.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/utils/ghq-integration.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/ghq-integration.jsView on unpkg

dist/utils/health-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/utils/health-checks.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/health-checks.jsView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

dist/mcp/install.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/mcp/install.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mcp/install.jsView on unpkg

dist/utils/bug-report.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/utils/bug-report.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/bug-report.jsView on unpkg

dist/utils/agent-config.jsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = dist/utils/agent-config.js matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/agent-config.jsView on unpkg

src/commands/configure.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = src/commands/configure.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/configure.tsView on unpkg

src/mcp/install.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = src/mcp/install.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/mcp/install.tsView on unpkg

src/utils/agent-config.test.tsView file

•matchType = normalized_sha256 matchedPackage = @nemus-cli/nemus@0.5.0 matchedPath = src/utils/agent-config.test.ts matchedIdentity = npm:QG5lbXVzLWNsaS9uZW11cw:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/agent-config.test.tsView on unpkg