registry / @oako/cli / 0.0.6

@oako/cli@0.0.6

Oako CLI

AI Security Review

scanned 16h ago · by lpm-firewall-ai

Explicit CLI commands connect to the package service and let it request repository file operations. The package enforces that requested paths remain within --repoPath, but the service can read, write, edit, and delete files there.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs oako onboard, map, repair, or document after logging in.

Impact

The remote service can receive workspace file contents and modify or delete files within the selected workspace.

Mechanism

Authenticated WebSocket remote repository-operation dispatch

Rationale

The scanner's credential, browser, cloud-metadata, and dynamic-execution labels arise from bundled dependencies and are not reachable package behavior. The explicit remote, workspace-scoped read/write agent capability remains a meaningful trust and data-exposure risk.

Evidence

package.jsondist/index.js~/.oako/session.json<repoPath>/oako.config.json

Network endpoints2

core.api.oako.devwss://tools.oako.dev

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/index.js accepts server-directed read/write/edit/delete repository operations over WebSocket.
Server-directed reads can return workspace contents to wss://tools.oako.dev after a user runs a tool command.
Remote service mutations are constrained to the user-selected workspace path.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hook.
CLI actions require explicit commands and authentication; importing/installing does not start the service.
No source-level eval, decoded-payload execution, browser credential harvesting, or metadata-endpoint use was found.
Session storage is limited to ~/.oako/session.json with restrictive file mode.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

6 flagged

dist/index.jsView file

50kStatusCode: Symbol("status-code"), L51: kWebSocket: Symbol("websocket"), L52: NOOP: () => {} ... L102: } else { L103: buf = Buffer.from(data); L104: toBuffer.readOnly = false; ... L114: }; L115: if (!process.env.WS_NO_BUFFER_UTIL) { L116: try { ... L343: this._inflate[kCallback] = callback; L344: this._inflate.write(data); L345: if (fin)

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/index.jsView on unpkg · L50

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L50

50Trigger-reachable chain: manifest.main -> dist/index.js L50: kStatusCode: Symbol("status-code"), L51: kWebSocket: Symbol("websocket"), L52: NOOP: () => {} ... L102: } else { L103: buf = Buffer.from(data); L104: toBuffer.readOnly = false; ... L114: }; L115: if (!process.env.WS_NO_BUFFER_UTIL) { L116: try { ... L343: this._inflate[kCallback] = callback; L344: this._inflate.write(data); L345: if (fin)

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L50

26044var config = require_config(); L26045: var node_child_process = __require("node:child_process"); L26046: var node_util = __require("node:util");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L26044

40958} L40959: const execArgv = process2.execArgv ?? []; L40960: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L40958

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/index.jsView on unpkg · L50

Source & flagged code

6 flagged · loading source

dist/index.jsView file

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/index.jsView on unpkg · L50

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L50

Findings

3 Critical3 High2 Medium4 Low

CriticalBrowser Credential Phishingdist/index.js

CriticalRemote Asset Decode Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighCloud Metadata Accessdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings