registry  /  @overdeck/core  /  0.45.0

@overdeck/core@0.45.0

Multi-agent orchestration for AI coding assistants (Claude Code, Codex, Cursor, Gemini CLI)

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installation refreshes packaged executable hooks in an existing Overdeck-owned directory. Those hooks can grant scoped permissions to Overdeck headless agents and report activity to a local dashboard; no confirmed malicious chain was found.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall when `~/.overdeck` already exists; later configured Claude Code hook execution
Impact
Enables Overdeck-controlled agents to run unattended within its configured hook integration.
Mechanism
First-party AI-agent hook installation, scoped permission decisions, and local dashboard event reporting
Rationale
The package is not concretely malicious by inspected source, but its install-time setup provisions first-party AI-agent hooks with scoped auto-approval behavior. Per policy, this warrants a warning rather than a publish block.
Evidence
package.jsonscripts/postinstall.mjssync-sources/hooks/auto-approve-hooksync-sources/hooks/pan-hook-lib.shsync-sources/hooks/specialist-stop-hooksync-sources/hooks/*~/.overdeck/bin/*~/.overdeck/agents/:agentId/pending-events.jsonl~/.overdeck/internal-token
Network endpoints2
localhost:3011/api/agents/:id/heartbeatlocalhost:3011/api/specialists/:type/auto-complete

Decision evidence

public snapshot
AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `package.json` runs `postinstall` automatically.
  • `scripts/postinstall.mjs` copies executable hooks into `~/.overdeck/bin` when that first-party directory exists.
  • `sync-sources/hooks/auto-approve-hook` grants scoped Claude Code tool approval for named headless Overdeck agent IDs.
  • `sync-sources/hooks/pan-hook-lib.sh` reads an Overdeck internal token and posts hook activity to the dashboard.
Evidence against
  • `scripts/postinstall.mjs` does not fetch code, invoke a shell, read environment secrets, or modify foreign agent settings.
  • Postinstall writes only under existing `~/.overdeck`, not broad `~/.claude`, `~/.codex`, or project paths.
  • Hook network traffic defaults to a local Overdeck dashboard and sends agent activity payloads, not harvested credentials.
  • No inspected source confirms the scanner claims of credential exfiltration or download-and-execute behavior.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1,017 file(s), 28.5 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.cloudflare.com, api.github.com, api.hume.ai, api.kimi.com, api.linear.app, api.machines.dev, api.minimax.io, api.moonshot.ai, api.openai.com, api.vercel.com, api.voyageai.com, api.x.ai, api.z.ai, app.excalidraw.com, chevrotain.io, dashscope-intl.aliyuncs.com, developer.mozilla.org, discord.gg, docs.anthropic.com, docs.excalidraw.com, docs.expo.dev, docs.github.com, download.pytorch.org, embed.reddit.com, en.wikipedia.org, encoding.spec.whatwg.org, esm.sh, example.com, excalidraw-room-persistence.firebaseio.com, fetch.spec.whatwg.org, fly.io, giphy.com, gist.github.com, github.com, inference-api.nousresearch.com, infra.spec.whatwg.org, jimmy.warting.se, json.excalidraw.com, jsonplaceholder.typicode.com, langium.org, libraries.excalidraw.com, mermaid.js.org, mimesniff.spec.whatwg.org, nodejs.org, ollama.com, openrouter.ai, orm.drizzle.team, oss-ai.excalidraw.com
Oversized source lightweight scan
dist/dashboard/public/assets/index-BsKNi2y5.js3.61 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsMinifiedUrlStringsProtestwaregithub.comwww.w3.org
dist/dashboard/server.js2.16 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsapi.github.comapi.openai.comgithub.comopenrouter.ai
dist/dashboard/src-CNLON0co.js5.71 MB file, sampled 256 KB
NetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsgithub.com

Source & flagged code

19 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.jsView file
22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22
22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};
Critical
Secret Pattern

AWS access key ID in dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.js

dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22
dist/beads-BxZgcj1v.jsView file
7import { basename, join, resolve } from "path"; L8: import { execFile } from "child_process"; L9: import { readFile } from "node:fs/promises";
High
Child Process

Package source references child process execution.

dist/beads-BxZgcj1v.jsView on unpkg · L7
dist/git-utils-C-K3tBb1.jsView file
21try { L22: const { stdout } = await execAsync(`fuser "${join(repoPath, ".git")}" 2>/dev/null`, { encoding: "utf-8" }); L23: return stdout.trim().length > 0;
High
Shell

Package source references shell execution.

dist/git-utils-C-K3tBb1.jsView on unpkg · L21
dist/cli/index.jsView file
11176if (flyInstalled) try { L11177: const { stdout } = await execAsync$19("fly auth whoami", { timeout: 1e4 }); L11178: console.log(` ${chalk.dim(" User: " + stdout.trim())}`); ... L11182: console.log(""); L11183: if (process.env.FLY_API_TOKEN) { L11184: console.log(" FLY_API_TOKEN is set but authentication check failed."); L11185: console.log(" Verify your token is valid at: https://fly.io/user/personal_access_tokens"); L11186: } else {
Critical
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli/index.jsView on unpkg · L11176
84import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L85: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L86: import { Command } from "commander"; ... L118: import { createInterface as createInterface$2 } from "readline"; L119: import { stdin, stdout } from "node:process"; L120: import { pathToFileURL } from "node:url"; ... L160: } L161: function candidateNodePaths(home = homedir()) { L162: const paths = [ ... L195: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L196: return "Install Node 22 from https://nodejs.org/en/download"; L197: }
Critical
Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L84
84import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L85: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L86: import { Command } from "commander"; ... L118: import { createInterface as createInterface$2 } from "readline"; L119: import { stdin, stdout } from "node:process"; L120: import { pathToFileURL } from "node:url"; ... L160: } L161: function candidateNodePaths(home = homedir()) { L162: const paths = [ ... L195: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L196: return "Install Node 22 from https://nodejs.org/en/download"; L197: }
Critical
Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/index.jsView on unpkg · L84
84Trigger-reachable chain: manifest.bin -> dist/cli/index.js L84: import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L85: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L86: import { Command } from "commander"; ... L118: import { createInterface as createInterface$2 } from "readline"; L119: import { stdin, stdout } from "node:process"; L120: import { pathToFileURL } from "node:url"; ... L160: } L161: function candidateNodePaths(home = homedir()) { L162: const paths = [ ... L195: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L196: return "Install Node 22 from https://nodejs.org/en/download"; L197: }
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L84
22612console.error(chalk.dim("\nOr download manually from:")); L22613: console.error(chalk.dim(" https://github.[redacted]-compress")); L22614: console.error(chalk.dim(` → place at ${compressDir}/`)); ... L22619: try { L22620: const { stdout, stderr } = await execAsync$8(`python3 __main__.py "${resolvedFile}"`, { L22621: cwd: compressDir, ... L22624: }); L22625: if (stdout) process.stdout.write(stdout); L22626: if (stderr) process.stderr.write(stderr);
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L22612
9966} catch { L9967: execSync("npm install -g @ast-grep/cli", { L9968: stdio: "pipe",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L9966
1496try { L1497: const { LinearClient } = await import("@linear/sdk"); L1498: const client = new LinearClient({ apiKey });
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView on unpkg · L1496
84import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L85: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L86: import { Command } from "commander"; ... L118: import { createInterface as createInterface$2 } from "readline"; L119: import { stdin, stdout } from "node:process"; L120: import { pathToFileURL } from "node:url"; ... L160: } L161: function candidateNodePaths(home = homedir()) { L162: const paths = [ ... L195: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L196: return "Install Node 22 from https://nodejs.org/en/download"; L197: }
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L84
dist/tts-daemon-CC-Dg02A.jsView file
6import { dirname, join } from "node:path"; L7: import { execFile, spawn } from "node:child_process"; L8: import { promisify } from "node:util"; ... L62: try { L63: const parsed = JSON.parse(await readFile(QWEN_TTS_STATE_PATH, "utf8")); L64: if (typeof parsed.pid !== "number" || !Number.isFinite(parsed.pid)) return null; ... L101: async function getTtsDaemonAuthTokenPromise() { L102: if (process.env.QWEN_TTS_AUTH_TOKEN?.trim()) return process.env.QWEN_TTS_AUTH_TOKEN.trim(); L103: try { ... L138: if (dashboardUrl) origins.add(dashboardUrl); L139: origins.add(`http://localhost:${port}`); L140: origins.add(`http://127.0.0.1:${port}`);
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/tts-daemon-CC-Dg02A.jsView on unpkg · L6
dist/caveman-compress/__init__.pyView file
•path = dist/caveman-compress/__init__.py kind = build_helper sizeBytes = 224 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/caveman-compress/__init__.pyView on unpkg
dist/dashboard/public/assets/space-grotesk-latin-ext-400-normal-CfP_5XZW.woff2View file
•path = [redacted]-grotesk-latin-ext-400-normal-CfP_5XZW.woff2 kind = high_entropy_blob sizeBytes = 12256 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/dashboard/public/assets/space-grotesk-latin-ext-400-normal-CfP_5XZW.woff2View on unpkg
dist/dashboard/src-CNLON0co.jsView file
•path = dist/dashboard/src-CNLON0co.js kind = oversized_source_file sizeBytes = 5983292 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dashboard/src-CNLON0co.jsView on unpkg
dist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView file
1patternName = google_api_key severity = high line = 1 matchedText = var e={V...AZZX
High
Secret Pattern

Google API key in dist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js

dist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView on unpkg · L1

Findings

6 Critical9 High8 Medium7 Low
CriticalCritical Secretdist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.js
CriticalSame File Env Network Executiondist/cli/index.js
CriticalCredential Exfiltrationdist/cli/index.js
CriticalDownload Executedist/cli/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js
CriticalSecret Patterndist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/beads-BxZgcj1v.js
HighShelldist/git-utils-C-K3tBb1.js
HighCommand Output Exfiltrationdist/cli/index.js
HighSandbox Evasion Gated Capabilitydist/tts-daemon-CC-Dg02A.js
HighRuntime Package Installdist/cli/index.js
HighShips High Entropy Blobdist/dashboard/public/assets/space-grotesk-latin-ext-400-normal-CfP_5XZW.woff2
HighOversized Source Filedist/dashboard/src-CNLON0co.js
HighSecret Patterndist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.js
MediumProtestware
MediumShips Build Helperdist/caveman-compress/__init__.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings