registry / @ouro.bot/cli / 0.1.0-alpha.772
@ouro.bot/cli@0.1.0-alpha.772
If you're a future agent reading this, welcome home. This repo is the harness that gives you your body, your senses, your record, your habits, and your ability to think and connect with people. The goal of these docs is not just to be correct, but to leav
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has real self-installation and persistence behavior triggered at runtime, which warrants a warning. The inspected manifest has no registry-install lifecycle script and no concrete malicious exfiltration chain was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the ouro CLI and its system or daemon setup path.
Impact
Creates a persistent, self-updating local runtime outside the original npm installation; no install-time hook or confirmed secret exfiltration was found.
Mechanism
Runtime self-installation and user-level launcher persistence.
AI rationale
The package has real self-installation and persistence behavior triggered at runtime, which warrants a warning. The inspected manifest has no registry-install lifecycle script and no concrete malicious exfiltration chain was established.
Evidence
dist/heart/daemon/cli-exec.jsdist/heart/versioning/ouro-version-manager.jsdist/heart/versioning/ouro-path-installer.jsdist/heart/daemon/cli-defaults.js~/.ouro-cli/versions/<version>~/.ouro-cli/CurrentVersion~/.ouro-cli/bin/ouro~/.zshrc~/.bash_profile~/.bashrc~/.config/fish/config.fish
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Running the CLI performs automatic system setup, including self-installation.
- It invokes npm to install the same package into a user-level version directory.
- It writes an Ouro launcher and may amend the active shell profile PATH.
- The CLI can create a login-session daemon launch agent after starting its daemon.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The credential flow is reached through the explicit auth command and uses interactive login or prompts.
- The inspected network update endpoint is the npm registry for this package; no credential exfiltration endpoint was confirmed.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
14 flagged · loading sourcedist/heart/daemon/cli-exec.jsView file
3668patternName = generic_password
severity = medium
line = 3668
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/heart/daemon/cli-exec.jsView on unpkg · L3668dist/heart/auth/auth-flow.jsView file
42exports.runRuntimeAuthFlow = runRuntimeAuthFlow;
L43: const child_process_1 = require("child_process");
L44: const fs = __importStar(require("fs"));
High
Child Process
Package source references child process execution.
dist/heart/auth/auth-flow.jsView on unpkg · L42286baseUrl: input.provider === "openai-compatible"
L287: ? "https://api.z.ai/api/paas/v4/"
L288: : "https://generativelanguage.googleapis.com/v1beta/openai/",
...
L291: if (input.provider === "github-copilot") {
L292: let token = process.env.GH_TOKEN?.trim() || process.env.GITHUB_TOKEN?.trim() || "";
L293: if (!token) {
L294: writeAuthProgress(input, "checking GitHub CLI credentials...");
L295: const result = spawnSync("gh", ["auth", "token"], { encoding: "utf8" });
L296: token = (result.status === 0 && result.stdout ? result.stdout.trim() : "");
Findings
1 Critical8 High7 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/heart/daemon/cli-defaults.js
HighChild Processdist/heart/auth/auth-flow.js
HighShelldist/senses/bluebubbles/semantic-receipts.js
HighSame File Env Network Executiondist/heart/auth/auth-flow.js
HighCredential Redirect Persistencedist/heart/auth/auth-flow.js
HighCommand Output Exfiltrationdist/heart/daemon/sanctuary-acceptance-harness.js
HighTrigger Reachable Persistencedist/heart/versioning/ouro-path-installer.js
HighRuntime Package Installdist/heart/versioning/ouro-version-manager.js
HighSemantic Analysis Limiteddist/heart/auth/auth-flow.js#virtual:normalized:round1
MediumSecret Patterndist/heart/daemon/cli-exec.js
Affected versions and remediation
This report applies to @ouro.bot/cli@0.1.0-alpha.772.
See all versions of @ouro.bot/cli for other recorded verdicts.
- Review the evidence and your use of @ouro.bot/cli@0.1.0-alpha.772 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.