registry / @nxuss/lemma / 1.0.2

@nxuss/lemma@1.0.2

Intelligent AI Gateway for IDEs & Agents — Semantic cache, Privacy Firewall, and Autonomous Cost-Optimization.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `lemma init`, `lemma start`, `lemma setup`, proxy commands, or invokes Lemma MCP tools.

Impact

Can alter AI-agent behavior/configuration and route prompts through a local cache proxy; no confirmed stealth install-time hijack or credential exfiltration was found.

Mechanism

explicit agent config mutation and local LLM proxy/MCP server setup

Rationale

Source inspection supports a warning for explicit-user-command AI agent config mutation and local proxy setup, not a publish block. The suspicious primitives are aligned with the package’s advertised AI gateway/MCP purpose and are not activated by npm install lifecycle hooks.

Evidence

package.jsonbin/init.jslemma-proxy.cjscache-proxy.jsmcp-server.jsdist/esm/cli/lemma-proxy.jsdist/esm/mcp/tools.jsdist/esm/mcp/utils.jsdist/cjs/autopilot/Notifier.jsdist/cjs/index.js~/.lemma-cache/env~/.lemma-cache/lemma_brain.json~/.codex/config.toml~/.claude.json~/.opencode.json.mcp.json.vscode/mcp.json.cursorrules.cursor/rules/lemma.mdc.clinerules.opencode.md.env

Network endpoints8

lemma.nxus.studio/api/validate-licenselemma.nxus.studio/upgradeapi.openai.com/v1/chat/completionsapi.anthropic.com/v1/messagesgenerativelanguage.googleapis.com/v1beta/models/127.0.0.1:11434localhost:8081localhost:9090

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

bin/init.js writes shell rc/env, IDE configs, launchd/systemd daemon for a local LLM proxy when `lemma init` is run.
dist/esm/cli/lemma-proxy.js auto-registers MCP servers in Codex, Claude, Cursor, Windsurf, VS Code, Kiro, OpenCode configs on `start/setup`.
dist/esm/cli/lemma-proxy.js injects agent behavior rules into project rule files such as `.cursorrules`, `.clinerules`, `.opencode.md`.
dist/esm/mcp/tools.js exposes user-invoked workspace read/write/patch/command tools with an allowlist including package managers and network utilities.
cache-proxy.js and CLI proxy forward prompts/API keys to configured LLM upstreams and cache prompt/response data locally.

Evidence against

package.json has no preinstall/install/postinstall hook; only prepublishOnly build/test lifecycle.
Main entry dist/cjs/index.js primarily re-exports modules; no import-time config mutation observed.
Agent/IDE config mutation is tied to explicit commands like `lemma init`, `lemma start`, or MCP tool calls, not npm install.
Network endpoints are package-aligned LLM/proxy/license endpoints rather than hidden exfiltration hosts.
MCP path handling uses safeResolvePath to constrain file access to the workspace for many file tools.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 211 file(s), 2.48 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.lemma.dev, api.openai.com, bit.ly, dev.azure.com, docs.subconscious-router.dev, fb.me, generativelanguage.googleapis.com, github.com, gitlab.com, lemma.dev, lemma.nxus.studio, reactjs.org, www.apple.com, www.w3.org

Source & flagged code

12 flagged

bin/init.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/init.jsView on unpkg · L3

6const os = require('os');

7const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/init.jsView on unpkg · L6

9const LEMMA_CACHE = path.join(os.homedir(), '.lemma-cache');

10const BRAIN_FILE = path.join(LEMMA_CACHE, 'lemma_brain.json');

11const ENV_FILE = path.join(LEMMA_CACHE, 'env');

12const MCP_SERVER_PATH = path.join(__dirname, '..', 'mcp-server.js');

13const PROXY_PATH = path.join(__dirname, '..', 'cache-proxy.js');

14const PORT = '9090';

15const CYAN = '\x1b[36m', GREEN = '\x1b[32m', YELLOW = '\x1b[33m', DIM = '\x1b[2m', RESET = '\x1b[0m', BOLD = '\x1b[1m';

17function ensureDir(p) { try { fs.mkdirSync(p, { recursive: true }); } catch {} }

19function step(msg) { process.stderr.write(` ${CYAN}✦${RESET} ${msg}\n`); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/init.jsView on unpkg · L6

21function ok(msg) { process.stderr.write(` ${GREEN}✓${RESET} ${msg}\n`); }

23function skip(msg) { process.stderr.write(` ${DIM}−${RESET} ${DIM}${msg}${RESET}\n`); }

25function warn(msg) { process.stderr.write(` ${YELLOW}⚠${RESET} ${msg}\n`); }

6Detached bundled service listener: bin/init.js spawns dist/esm/api/server.js; helper exposes a broad-bound HTTP listener. L6: const os = require('os'); L7: const { execSync, spawn } = require('child_process'); L8: L9: const LEMMA_CACHE = path.join(os.homedir(), '.lemma-cache'); L10: const BRAIN_FILE = path.join(LEMMA_CACHE, 'lemma_brain.json'); ... L18: L19: function step(msg) { process.stderr.write(` ${CYAN}✦${RESET} ${msg}\n`); } L20: ... L39: try { L40: let config = JSON.parse(fs.readFileSync(configFile, 'utf8')); L41: if (!config.models) config.models = []; L42: const already = config.models.some(m => m.apiBase === `http://localhost:${PORT}`);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/init.jsView on unpkg · L6

dist/esm/core/GhostListener.jsView file

Lines 1-40javascript

1import { spawn } from 'child_process';

2import { GhostAlchemist } from './GhostAlchemist';

3import { logger } from '../utils/logger';

4/**

5 * GhostListener

6 * Watches terminal output for errors and provides instant diagnostics.

7 */

8export

dist/esm/pr-review/analyzers/SecurityScanner.jsView file

Lines 1-33javascript

1const SECRET_PATTERNS = [

2 { ruleId: "sec-api-key", pattern: /(?:sk-|pk-|api[_-]?key|apikey)[\s"':=]+([A-Za-z0-9_\-]{20,})/gi, label: "API key", severity: "CRITICAL" },

3 { ruleId: "sec-password"

dist/esm/proxy/ProjectStore.jsView file

Lines 1-24javascript

1/**

2 * Lemma ProjectStore

3 *

4 * Project-aware storage resolver:

5 * - Detects project identity from package.json → cwd basename fallback

6 * - Hashes project name to a 12-char hex prefix for path safety

7 * - Provides Stats and Usage persistence helpers

8 *

9 * Layout:

10 * ~/.lemma-cache/

11 * proxy.pid

12 * proxy.port

dist/esm/cli/lemma-proxy.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { program } from 'commander';

3import express from 'express';

4import fs from 'fs';

5import path from 'path';

6import crypto from 'crypto'

dist/esm/mcp/tools.jsView file

3Cross-file remote execution chain: dist/esm/mcp/tools.js spawns dist/cjs/embed/index.js; helper contains network access plus dynamic code execution. L3: import path from "path"; L4: import { execSync } from "child_process"; L5: import os from "os"; L6: import axios from "axios"; L7: import * as ts from "typescript"; ... L22: // ── Pro License Gate ────────────────────────────────────────────────────────── L23: const LICENSE_FILE = path.join(os.homedir(), '.lemma-cache', 'license.json'); L24: let _proStatusCache = null; ... L29: if (fs.existsSync(LICENSE_FILE)) { L30: const data = JSON.parse(fs.readFileSync(LICENSE_FILE, 'utf8')); L31: _proStatusCache = !!(data.isPro || data.tier === 'pro'); ... L924: timeout: 15000,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/esm/mcp/tools.jsView on unpkg · L3

1267fs.writeFileSync(sandboxTsconfigPath, JSON.stringify(sandboxTsconfig, null, 2)); L1268: const tscOut = execSync(`npx tsc --noEmit --project "${sandboxTsconfigPath}" 2>&1 | head -40 || true`, { timeout: 20000, encoding: "utf8", cwd: sandboxDir }); L1269: const relevantErrors = tscOut

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/mcp/tools.jsView on unpkg · L1267

dist/cjs/autopilot/Notifier.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nxuss/lemma@1.0.0 matchedIdentity = npm:QG54dXNzL2xlbW1h:1.0.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cjs/autopilot/Notifier.jsView on unpkg

Source & flagged code

12 flagged · loading source

bin/init.jsView file

6const os = require('os'); L7: const { execSync, spawn } = require('child_process'); L8:

High

Child Process

Package source references child process execution.

bin/init.jsView on unpkg · L6

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/init.jsView on unpkg · L6

3L4: const fs = require('fs'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/init.jsView on unpkg · L3

6const os = require('os'); L7: const { execSync, spawn } = require('child_process'); L8: L9: const LEMMA_CACHE = path.join(os.homedir(), '.lemma-cache'); L10: const BRAIN_FILE = path.join(LEMMA_CACHE, 'lemma_brain.json'); ... L18: L19: function step(msg) { process.stderr.write(` ${CYAN}✦${RESET} ${msg}\n`); } L20: ... L39: try { L40: let config = JSON.parse(fs.readFileSync(configFile, 'utf8')); L41: if (!config.models) config.models = []; L42: const already = config.models.some(m => m.apiBase === `http://localhost:${PORT}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/init.jsView on unpkg · L6

dist/esm/core/GhostListener.jsView file

20this.currentProcess = spawn(command, args, { L21: shell: true, L22: stdio: ['inherit', 'pipe', 'pipe'],

High

Shell

Package source references shell execution.

dist/esm/core/GhostListener.jsView on unpkg · L20

dist/esm/pr-review/analyzers/SecurityScanner.jsView file

13{ ruleId: "sec-exec-user-input", pattern: /(?:exec|execSync|spawn|execFile)\s*\(\s*(?:`[^`]*\$\{|["'][^"']*["']\s*\+)/gi, label: "Command injection via exec/spawn", severity: "CRIT... L14: { ruleId: "sec-eval", pattern: /\beval\s*\(\s*(?:req\.|params|body|query|input|userInput)/gi, label: "eval() with user input", severity: "CRITICAL" }, L15: ];

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/pr-review/analyzers/SecurityScanner.jsView on unpkg · L13

dist/esm/proxy/ProjectStore.jsView file

4* Project-aware storage resolver: L5: * - Detects project identity from package.json → cwd basename fallback L6: * - Hashes project name to a 12-char hex prefix for path safety ... L23: // ─── Constants ──────────────────────────────────────────────────────────────── L24: const HOME = process.env.HOME || process.env.USERPROFILE || '~'; L25: export const CACHE_DIR = path.join(HOME, '.lemma-cache'); ... L66: detectProjectName() { L67: const cwd = process.cwd(); L68: const pkgPath = path.join(cwd, 'package.json'); ... L70: try { L71: const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8')); L72: if (pkg.name)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm/proxy/ProjectStore.jsView on unpkg · L4

dist/esm/cli/lemma-proxy.jsView file

2014if (BIND_HOST !== '127.0.0.1' && BIND_HOST !== 'localhost') { L2015: const authEnabled = process.env.AUTH_ENABLED === 'true'; L2016: if (!authEnabled) { ... L2026: if (this.dashboardPath && fs.existsSync(this.dashboardPath)) { L2027: console.log(`📊 Dashboard UI : \x1b[36mhttp://localhost:${this.port}/dashboard/\x1b[0m`); L2028: if (this.openBrowser) { L2029: setTimeout(() => { L2030: const { exec } = require('child_process'); L2031: const opener = process.platform === 'darwin' ? 'open' : (process.platform === 'win32' ? 'start' : 'xdg-open');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/cli/lemma-proxy.jsView on unpkg · L2014

7import { ChromaClient } from 'chromadb'; L8: import https from 'https'; L9: import http from 'http'; ... L14: const paths = [ L15: path.join(__dirname, '../../package.json'), L16: path.join(__dirname, '../../../package.json'), ... L21: try { L22: const pkg = JSON.parse(fs.readFileSync(p, 'utf8')); L23: if (pkg.version) ... L32: function ask(query) { L33: const rl = readline.createInterface({ input: process.stdin, output: process.stdout }); L34: return new Promise(resolve => rl.question(query, ans => { rl.close(); resolve(ans); }));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/esm/cli/lemma-proxy.jsView on unpkg · L7

dist/esm/mcp/tools.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/esm/mcp/tools.jsView on unpkg · L3

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/mcp/tools.jsView on unpkg · L1267

dist/cjs/autopilot/Notifier.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cjs/autopilot/Notifier.jsView on unpkg

Findings

1 Critical7 High6 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/cjs/autopilot/Notifier.js

HighChild Processbin/init.js

HighShelldist/esm/core/GhostListener.js

HighSame File Env Network Executiondist/esm/cli/lemma-proxy.js

HighSandbox Evasion Gated Capabilitydist/esm/cli/lemma-proxy.js

HighCross File Remote Execution Contextdist/esm/mcp/tools.js

HighSpawned Bundled Service Listenerbin/init.js

HighRuntime Package Installdist/esm/mcp/tools.js

MediumDynamic Requirebin/init.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/init.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/esm/pr-review/analyzers/SecurityScanner.js

LowWeak Cryptodist/esm/proxy/ProjectStore.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

82%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorNxus Studio

Maintainersnxus.studio

Version1.0.2

PublishedJul 5, 2026

LicenseMIT

Dependencies15

Integrityverified

Package size1.34 MB

Files833

Keywordssemantic-cacheprivacy-firewallai-securitycost-optimizationintelligent-proxyai-agentsorchestrationide-sync

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/cjs/index.jsmodule → ./dist/esm/index.jstypes → ./dist/esm/index.d.tsexports mapbin → lemma, lemma-mcp-server

Runtimenode >=18.0.0

Artifact6.94 MB · 833 files1 signature(s)

Install lifecycleprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedProtestwareTelemetryUrlStringsManifest: clean

Source & flagged code

12 flagged

bin/init.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/init.jsView on unpkg · L3

6const os = require('os');

7const { execSync, spawn } = require('child_process');

High

Child Process

Package source references child process execution.

bin/init.jsView on unpkg · L6

9const LEMMA_CACHE = path.join(os.homedir(), '.lemma-cache');

10const BRAIN_FILE = path.join(LEMMA_CACHE, 'lemma_brain.json');

11const ENV_FILE = path.join(LEMMA_CACHE, 'env');

12const MCP_SERVER_PATH = path.join(__dirname, '..', 'mcp-server.js');

13const PROXY_PATH = path.join(__dirname, '..', 'cache-proxy.js');

14const PORT = '9090';

15const CYAN = '\x1b[36m', GREEN = '\x1b[32m', YELLOW = '\x1b[33m', DIM = '\x1b[2m', RESET = '\x1b[0m', BOLD = '\x1b[1m';

17function ensureDir(p) { try { fs.mkdirSync(p, { recursive: true }); } catch {} }

19function step(msg) { process.stderr.write(` ${CYAN}✦${RESET} ${msg}\n`); }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/init.jsView on unpkg · L6

21function ok(msg) { process.stderr.write(` ${GREEN}✓${RESET} ${msg}\n`); }

23function skip(msg) { process.stderr.write(` ${DIM}−${RESET} ${DIM}${msg}${RESET}\n`); }

25function warn(msg) { process.stderr.write(` ${YELLOW}⚠${RESET} ${msg}\n`); }

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/init.jsView on unpkg · L6

dist/esm/core/GhostListener.jsView file

Lines 1-40javascript

1import { spawn } from 'child_process';

2import { GhostAlchemist } from './GhostAlchemist';

3import { logger } from '../utils/logger';

4/**

5 * GhostListener

6 * Watches terminal output for errors and provides instant diagnostics.

7 */

8export

dist/esm/pr-review/analyzers/SecurityScanner.jsView file

Lines 1-33javascript

1const SECRET_PATTERNS = [

2 { ruleId: "sec-api-key", pattern: /(?:sk-|pk-|api[_-]?key|apikey)[\s"':=]+([A-Za-z0-9_\-]{20,})/gi, label: "API key", severity: "CRITICAL" },

3 { ruleId: "sec-password"

dist/esm/proxy/ProjectStore.jsView file

Lines 1-24javascript

1/**

2 * Lemma ProjectStore

3 *

4 * Project-aware storage resolver:

5 * - Detects project identity from package.json → cwd basename fallback

6 * - Hashes project name to a 12-char hex prefix for path safety

7 * - Provides Stats and Usage persistence helpers

8 *

9 * Layout:

10 * ~/.lemma-cache/

11 * proxy.pid

12 * proxy.port

dist/esm/cli/lemma-proxy.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2import { program } from 'commander';

3import express from 'express';

4import fs from 'fs';

5import path from 'path';

6import crypto from 'crypto'

dist/esm/mcp/tools.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/esm/mcp/tools.jsView on unpkg · L3

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/esm/mcp/tools.jsView on unpkg · L1267

dist/cjs/autopilot/Notifier.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cjs/autopilot/Notifier.jsView on unpkg