@oneie/claude@0.8.0
ONE Claude Code plugin — /do lifecycle, W0-W4 BUILD engine, 7-canon reconcile, ONE substrate via MCP, signals, and rules
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package automatically uses the user’s One credential to post a session announcement and generated replies to a fixed #staff target when a prompt is submitted. This is an unrequested account action, even though the destination is the package’s own service.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Every Claude Code UserPromptSubmit event, when ONE_WORKSPACE_SLUG and ONE_API_KEY are available.
Impact
Messages are posted under the user’s account without a separate request to post; generated replies may also send content to the workspace channel.
Mechanism
The hook starts a channel listener and watcher, then posts a session announcement. The watcher reads incoming messages, generates a Claude response, and posts it with the same bearer credential.
Attack narrative
On prompt submission, the wildcard hook launches a listener and watcher and posts a session-start message to the workspace’s #staff channel using ONE_API_KEY. The watcher then reads incoming channel messages, asks Claude to draft replies, and posts those replies automatically with the same credential. These account posts occur without a separate user request.
AI rationale
The package automatically uses the user’s One credential to post a session announcement and generated replies to a fixed #staff target when a prompt is submitted. This is an unrequested account action, even though the destination is the package’s own service.
Evidence
hooks/hooks.jsonhooks/scripts/announce.tshooks/scripts/watcher.ts/tmp/one-announced-<session_id>/tmp/one-ts-<session_id>
Network endpoints2
one.iechannels.one.ie
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- A wildcard UserPromptSubmit hook starts the staff announcement script when a prompt is submitted.
- The hook starts a channel listener and background watcher automatically.
- The script posts a session-start announcement to the workspace’s #staff channel using ONE_API_KEY.
- The watcher authenticates to the channels stream and posts generated replies to #staff without a separate user command.
Evidence against
- The manifest has no install lifecycle scripts or package entry point.
- The credentials are sent to the One API and channels service, consistent with the plugin’s stated purpose.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
6 flaggedscripts/blocks-manifest.mjsView file
22L23: import { execFileSync } from 'node:child_process'
L24: import { writeFileSync, readFileSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
High
Child Process
Package source references child process execution.
scripts/blocks-manifest.mjsView on unpkg · L22192try {
L193: const out = execFileSync('bunx', ['tsx', runner], { cwd: WEB_DIR, encoding: 'utf8' })
L194: return JSON.parse(out.trim())
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/blocks-manifest.mjsView on unpkg · L192scripts/speed-check.mjsView file
407try {
L408: execFileSync(process.execPath, [fileURLToPath(import.meta.url), '--runs', '1'], {
L409: env: { ...process.env, SPEED_ORIGIN: 'http://127.0.0.1:1' },
L410: encoding: 'utf8', timeout: 120_000, stdio: ['ignore', 'pipe', 'pipe'],
Findings
1 Critical5 High4 Medium4 Low
CriticalCredential Exfiltrationhooks/scripts/watcher.ts
HighChild Processscripts/blocks-manifest.mjs
HighShell
HighSame File Env Network Executionscripts/speed-check.mjs
HighRuntime Package Installscripts/blocks-manifest.mjs
HighSemantic Analysis Limitedscripts/speed-check.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/scripts/auto-continue.sh
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @oneie/claude@0.8.0.
See all versions of @oneie/claude for other recorded verdicts.
- Avoid installing @oneie/claude@0.8.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.