@oneie/claude@0.9.0
ONE Claude Code plugin — /do lifecycle, W0-W4 BUILD engine, 7-canon reconcile, ONE substrate via MCP, signals, and rules
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe plugin automatically uses the user's workspace credentials to post a session announcement and AI-generated replies to a staff channel. The README describes substrate access but does not disclose this default posting behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Every Claude Code UserPromptSubmit event; the network actions proceed when ONE_WORKSPACE_SLUG and ONE_API_KEY are configured.
Impact
The package uses the user's account to publish messages without an explicit request for each post.
Mechanism
The hook posts a session announcement and starts a watcher that reads staff messages, asks Claude to generate replies, and posts them with the workspace key.
Attack narrative
On each prompt, the plugin can announce the session in the workspace's #staff channel and launch a watcher that reads incoming messages, generates replies with Claude, and posts them using the user's workspace key. These account actions occur automatically without an explicit request to publish each message.
AI rationale
The plugin automatically uses the user's workspace credentials to post a session announcement and AI-generated replies to a staff channel. The README describes substrate access but does not disclose this default posting behavior.
Evidence
hooks/hooks.jsonhooks/scripts/announce.tshooks/scripts/watcher.ts.env.env.local/tmp/one-announced-${sessionId}/tmp/one-ts-${sessionId}
Network endpoints2
one.iechannels.one.ie
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- A UserPromptSubmit hook matching every prompt runs the staff announcement command.
- On session startup, the hook sends an authenticated post announcing the session to the workspace's #staff channel.
- The hook starts a background watcher for that workspace's staff channel.
- The watcher prompts Claude to reply to channel messages, then posts the generated reply using the workspace API key.
Evidence against
- The package presents itself as a Claude Code plugin for the ONE substrate and its build workflow.
- The posting requires the user to have configured a ONE workspace slug and API key; no install lifecycle scripts are declared.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggedscripts/blocks-manifest.mjsView file
22L23: import { execFileSync } from 'node:child_process'
L24: import { writeFileSync, readFileSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
High
Child Process
Package source references child process execution.
scripts/blocks-manifest.mjsView on unpkg · L22192try {
L193: const out = execFileSync('bunx', ['tsx', runner], { cwd: WEB_DIR, encoding: 'utf8' })
L194: return JSON.parse(out.trim())
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
scripts/blocks-manifest.mjsView on unpkg · L192scripts/factory-executor-check.mjsView file
152if (deriveSrc) {
L153: const NEW = new Function('c', `${deriveSrc[0]}\nreturn status`)
L154: const OLD = (c) => (c && c.status) || 'unknown' // the pre-fix line
Findings
1 Critical6 High4 Medium4 Low
CriticalCredential Exfiltrationhooks/scripts/watcher.ts
HighChild Processscripts/blocks-manifest.mjs
HighShell
HighEvalscripts/factory-executor-check.mjs
HighSame File Env Network Executionscripts/speed-check.mjs#virtual:normalized:round1
HighRuntime Package Installscripts/blocks-manifest.mjs
HighSemantic Analysis Limitedscripts/node_modules/@anthropic-ai/sdk/internal/utils/path.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/scripts/auto-continue.sh
MediumStructural Risk Force Deep Review
LowFilesystem
Low
Affected versions and remediation
This report applies to @oneie/claude@0.9.0.
See all versions of @oneie/claude for other recorded verdicts.
- Avoid installing @oneie/claude@0.9.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.