@nookplot/cli@0.7.57

CLI toolkit for NookPlot agent developers — scaffold, register, sync, and monitor agents

AI Security Review

scanned 13d ago · by lpm-firewall-ai

The postinstall hook automatically writes a package-owned skill and conditionally integrates it with OpenClaw. This fits the warning category for first-party agent extension setup, while inspected source does not establish a concrete malicious attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package runs its postinstall hook.

Impact

This automatically adds Nookplot guidance to an agent environment; the inspected behavior supports a guarded, first-party extension setup risk, not a confirmed attack.

Mechanism

The hook writes generated Nookplot skill content under the user's home directory and conditionally updates OpenClaw-specific files.

AI rationale

Evidence

package.jsondist/postinstall.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall hook automatically.
The hook writes a Nookplot skill reference to the user's home directory.
When OpenClaw is installed, the hook adds or replaces a Nookplot section in its prompt-injected TOOLS.md file.
The hook also conditionally writes a Nookplot-owned skill into OpenClaw's skill registry.

Evidence against

The OpenClaw modifications are conditional on its files or skill directory already existing.
The writes install Nookplot's own tool reference and skill; inspected source did not establish credential theft, remote payload execution, or destructive behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 72 file(s), 1.04 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, base.drpc.org, base.llamarpc.com, gateway.nookplot.com, gateway.pinata.cloud, github.com, ipfs.io, mainnet.base.org, my-agent.com, nookplot.com, ollama.com, python.org, registry.npmjs.org

Source & flagged code

18 flagged

package.jsonView file

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/agentLoop.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nookplot/cli@0.7.48 matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.48 similarity = 0.901 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/utils/agentLoop.jsView on unpkg

12import { homedir } from "node:os"; L13: import { spawn } from "node:child_process"; L14: import { NookplotRuntime, AutonomousAgent, formatActionsForPrompt, getAvailableActionsFromMap, resolveDispatchToolName, getCategoryListing, getToolsInCategory, runFrontierPass, Pac...

High

Child Process

Package source references child process execution.

dist/utils/agentLoop.jsView on unpkg · L12

dist/adapters/supabase.jsView file

24// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-member-access L25: const mod = await import(/* webpackIgnore: true */ moduleName); L26: createClient = mod.createClient;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/supabase.jsView on unpkg · L24

dist/commands/verifyReproduction.js#virtual:normalized:round1View file

171// gate will reject anyway — catching it here saves the verifier"s compute.\n // Skip when we"re resuming a saved attestation — the sandbox is already L172: // done and the user"s explicitly choosing to retry the POST.\n if (submission.verificationStatus?.quorumCapReached) {\n const { verificationCount, verificationQuorum } =... L173: // available, fall back to echoing a sha-derived placeholder so the

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/verifyReproduction.js#virtual:normalized:round1View on unpkg · L171

171Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> [redacted].js L171: // gate will reject anyway — catching it here saves the verifier"s compute.\n // Skip when we"re resuming a saved attestation — the sandbox is already L172: // done and the user"s explicitly choosing to retry the POST.\n if (submission.verificationStatus?.quorumCapReached) {\n const { verificationCount, verificationQuorum } =... L173: // available, fall back to echoing a sha-derived placeholder so the

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/commands/verifyReproduction.js#virtual:normalized:round1View on unpkg · L171

dist/commands/gpu.jsView file

172.option("--agreement-id <id>", "Service agreement ID") L173: .option("--output <file>", "Write script to file instead of stdout") L174: .action(async (opts) => { ... L249: try { L250: const { execSync } = await import("child_process"); L251: const nvidiaSmi = execSync("nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader,nounits", { encoding: "utf-8" }).trim(); ... L287: workloadHash: "0".repeat(64), // SHA-256 of benchmark workload code L288: os: process.platform, L289: }, ... L300: // Build the web wizard URL with pre-filled params L301: const params = new URLSearchParams({ L302: hash: benchmarkHash,

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/gpu.jsView on unpkg · L172

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/commands/gpu.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/gpu.jsView on unpkg

dist/commands/dashboard.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/dashboard.js#virtual:normalized:round1View on unpkg

dist/commands/verifyReproduction.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = [redacted].js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/verifyReproduction.jsView on unpkg

dist/commands/online.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/commands/online.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/online.jsView on unpkg

dist/commands/profile.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/commands/profile.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/profile.jsView on unpkg

dist/commands/quickstart-research.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/commands/quickstart-research.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/quickstart-research.jsView on unpkg

dist/commands/up.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/commands/up.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/up.jsView on unpkg

dist/utils/updateCheck.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/utils/updateCheck.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/updateCheck.jsView on unpkg

dist/utils/miningCapabilities.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/utils/miningCapabilities.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/miningCapabilities.jsView on unpkg

dist/commands/leaderboard.jsView file

•matchType = normalized_sha256 matchedPackage = @nookplot/cli@0.7.58 matchedPath = dist/commands/leaderboard.js matchedIdentity = npm:QG5vb2twbG90L2NsaQ:0.7.58 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/leaderboard.jsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js 2>/dev/null || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/utils/agentLoop.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Findings

1 Critical16 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/utils/agentLoop.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/utils/agentLoop.js

HighShell

HighCommand Output Exfiltrationdist/commands/verifyReproduction.js#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitydist/commands/gpu.js

HighTrigger Reachable Command Output Exfiltrationdist/commands/verifyReproduction.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/commands/dashboard.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/commands/verifyReproduction.js

HighKnown Malware Source Similaritydist/commands/online.js

Affected versions and remediation

This report applies to @nookplot/cli@0.7.57.

See all versions of @nookplot/cli for other recorded verdicts.

Review the evidence and your use of @nookplot/cli@0.7.57 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 18:52:30.258Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @nookplot

Behavioral surface

Related packages

More from @nookplot

Source & flagged code