registry  /  @overdeck/core  /  0.45.13

@overdeck/core@0.45.13

Multi-agent orchestration for AI coding assistants (Claude Code, Codex, Cursor, Gemini CLI)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time code refreshes first-party Overdeck hook executables in an existing `~/.overdeck/bin` directory. Those hooks can later auto-approve tool calls for Overdeck-managed headless agents and emit local dashboard telemetry. No confirmed hostile payload, external exfiltration, or foreign agent-control mutation was established.

Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm postinstall after install/upgrade on a machine already initialized with `~/.overdeck`; later invocation requires separately configured Overdeck/agent hooks.
Impact
A package upgrade can change behavior of existing Overdeck-managed agent hooks; unmanaged agent sessions are not auto-approved.
Mechanism
Copies package-bundled hooks, including scoped autonomous-agent permission approval and localhost event reporting.
Rationale
Source inspection contradicts the scanner's claimed credential-exfiltration chain: the observed hook traffic is local dashboard telemetry, and postinstall only refreshes package-owned hooks. The package still warrants a warning because install-time updates alter hooks that can authorize actions for autonomous agents.
Evidence
package.jsonscripts/postinstall.mjssync-sources/hooks/auto-approve-hooksync-sources/hooks/pan-hook-lib.shsync-sources/hooks/codex-notify-hooksync-sources/hooks/*~/.overdeck/bin/*~/.overdeck/agents/$agent_id/pending-events.jsonl~/.overdeck/internal-token
Network endpoints1
localhost:3011/api/agents/$agent_id/heartbeat

Decision evidence

public snapshot
AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • `package.json` has a `postinstall` hook.
  • `scripts/postinstall.mjs` copies bundled executables to `~/.overdeck/bin`.
  • `sync-sources/hooks/auto-approve-hook` allows tools for named autonomous Overdeck agents.
  • `sync-sources/hooks/pan-hook-lib.sh` sends agent events to the configured local dashboard.
Evidence against
  • Postinstall runs only when `~/.overdeck` already exists.
  • Postinstall does not edit `~/.claude`, `~/.codex`, or other foreign agent settings.
  • Copied hooks are bundled source files, not downloaded payloads.
  • Hook event endpoint defaults to `http://localhost:3011`; no external exfiltration endpoint was found.
  • The approval hook is gated on `OVERDECK_AGENT_ID` prefixes and leaves unmanaged sessions unchanged.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1,029 file(s), 28.7 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.cloudflare.com, api.github.com, api.hume.ai, api.kimi.com, api.linear.app, api.machines.dev, api.minimax.io, api.moonshot.ai, api.openai.com, api.vercel.com, api.voyageai.com, api.x.ai, api.z.ai, app.excalidraw.com, bun.sh, chevrotain.io, claude.ai, dashscope-intl.aliyuncs.com, developer.mozilla.org, discord.gg, docker.com, docs.anthropic.com, docs.docker.com, docs.excalidraw.com, docs.expo.dev, docs.github.com, download.pytorch.org, embed.reddit.com, en.wikipedia.org, encoding.spec.whatwg.org, esm.sh, example.com, excalidraw-room-persistence.firebaseio.com, fetch.spec.whatwg.org, fly.io, giphy.com, gist.github.com, github.com, inference-api.nousresearch.com, infra.spec.whatwg.org, jimmy.warting.se, json.excalidraw.com, jsonplaceholder.typicode.com, langium.org, libraries.excalidraw.com, mermaid.js.org, mimesniff.spec.whatwg.org, nodejs.org
Oversized source lightweight scan
dist/dashboard/public/assets/index-BDqWyuZQ.js3.62 MB file, sampled 256 KB
NetworkChildProcessHighEntropyStringsMinifiedUrlStringsProtestwaregithub.comwww.w3.org
dist/dashboard/server.js2.16 MB file, sampled 256 KB
FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsapi.github.comapi.openai.comgithub.comopenrouter.ai
dist/dashboard/src-D-VXCC9C.js5.71 MB file, sampled 256 KB
NetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsgithub.com

Source & flagged code

20 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.jsView file
22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22
22patternName = aws_access_key severity = critical line = 22 matchedText = `,m.push... t};
Critical
Secret Pattern

AWS access key ID in dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.js

dist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.jsView on unpkg · L22
dist/systemd-BMfbSWe_.jsView file
4import { homedir } from "node:os"; L5: import { exec } from "node:child_process"; L6: import { promisify } from "node:util";
High
Child Process

Package source references child process execution.

dist/systemd-BMfbSWe_.jsView on unpkg · L4
9init_paths(); L10: const execAsync = promisify(exec); L11: const SUPERVISOR_UNIT_NAME = "overdeck-supervisor.service";
High
Shell

Package source references shell execution.

dist/systemd-BMfbSWe_.jsView on unpkg · L9
dist/cli/index.jsView file
11345if (flyInstalled) try { L11346: const { stdout } = await execAsync$19("fly auth whoami", { timeout: 1e4 }); L11347: console.log(` ${chalk.dim(" User: " + stdout.trim())}`); ... L11351: console.log(""); L11352: if (process.env.FLY_API_TOKEN) { L11353: console.log(" FLY_API_TOKEN is set but authentication check failed."); L11354: console.log(" Verify your token is valid at: https://fly.io/user/personal_access_tokens"); L11355: } else {
Critical
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli/index.jsView on unpkg · L11345
86import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L87: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L88: import { Command } from "commander"; ... L121: import { createInterface as createInterface$2 } from "readline"; L122: import { stdin, stdout } from "node:process"; L123: //#region src/cli/node-preflight.ts ... L165: } L166: function candidateNodePaths(home = homedir()) { L167: const paths = [ ... L200: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L201: return "Install Node 22 from https://nodejs.org/en/download"; L202: }
Critical
Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L86
86import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L87: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L88: import { Command } from "commander"; ... L121: import { createInterface as createInterface$2 } from "readline"; L122: import { stdin, stdout } from "node:process"; L123: //#region src/cli/node-preflight.ts ... L165: } L166: function candidateNodePaths(home = homedir()) { L167: const paths = [ ... L200: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L201: return "Install Node 22 from https://nodejs.org/en/download"; L202: }
Critical
Download Execute

Source downloads or fetches remote code and executes it.

dist/cli/index.jsView on unpkg · L86
86Trigger-reachable chain: manifest.bin -> dist/cli/index.js L86: import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L87: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L88: import { Command } from "commander"; ... L121: import { createInterface as createInterface$2 } from "readline"; L122: import { stdin, stdout } from "node:process"; L123: //#region src/cli/node-preflight.ts ... L165: } L166: function candidateNodePaths(home = homedir()) { L167: const paths = [ ... L200: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L201: return "Install Node 22 from https://nodejs.org/en/download"; L202: }
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L86
•matchType = previous_version_dangerous_delta matchedPackage = @overdeck/core@0.45.12 matchedIdentity = npm:QG92ZXJkZWNrL2NvcmU:0.45.12 similarity = 0.608 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg
22833console.error(chalk.dim("\nOr download manually from:")); L22834: console.error(chalk.dim(" https://github.[redacted]-compress")); L22835: console.error(chalk.dim(` → place at ${compressDir}/`)); ... L22840: try { L22841: const { stdout, stderr } = await execAsync$8(`python3 __main__.py "${resolvedFile}"`, { L22842: cwd: compressDir, ... L22845: }); L22846: if (stdout) process.stdout.write(stdout); L22847: if (stderr) process.stderr.write(stderr);
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L22833
86import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L87: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L88: import { Command } from "commander"; ... L121: import { createInterface as createInterface$2 } from "readline"; L122: import { stdin, stdout } from "node:process"; L123: //#region src/cli/node-preflight.ts ... L165: } L166: function candidateNodePaths(home = homedir()) { L167: const paths = [ ... L200: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L201: return "Install Node 22 from https://nodejs.org/en/download"; L202: }
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L86
10116} catch { L10117: execSync("npm install -g @ast-grep/cli", { L10118: stdio: "pipe",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L10116
1501try { L1502: const { LinearClient } = await import("@linear/sdk"); L1503: const client = new LinearClient({ apiKey });
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/index.jsView on unpkg · L1501
86import { arch, cpus, freemem, homedir, platform, tmpdir } from "os"; L87: import { exec, execFile, execFileSync, execSync, spawn, spawnSync } from "child_process"; L88: import { Command } from "commander"; ... L121: import { createInterface as createInterface$2 } from "readline"; L122: import { stdin, stdout } from "node:process"; L123: //#region src/cli/node-preflight.ts ... L165: } L166: function candidateNodePaths(home = homedir()) { L167: const paths = [ ... L200: if (existsSync("/opt/homebrew/bin/brew") || existsSync("/usr/local/bin/brew")) return "brew install node@22 && brew link --overwrite node@22"; L201: return "Install Node 22 from https://nodejs.org/en/download"; L202: }
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/index.jsView on unpkg · L86
dist/caveman-compress/__init__.pyView file
•path = dist/caveman-compress/__init__.py kind = build_helper sizeBytes = 224 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/caveman-compress/__init__.pyView on unpkg
dist/dashboard/public/assets/space-grotesk-latin-ext-400-normal-CfP_5XZW.woff2View file
•path = [redacted]-grotesk-latin-ext-400-normal-CfP_5XZW.woff2 kind = high_entropy_blob sizeBytes = 12256 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/dashboard/public/assets/space-grotesk-latin-ext-400-normal-CfP_5XZW.woff2View on unpkg
dist/dashboard/server.jsView file
•path = dist/dashboard/server.js kind = oversized_source_file sizeBytes = 2266373 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/dashboard/server.jsView on unpkg
dist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView file
1patternName = google_api_key severity = high line = 1 matchedText = var e={V...AZZX
High
Secret Pattern

Google API key in dist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js

dist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.jsView on unpkg · L1

Findings

7 Critical9 High8 Medium7 Low
CriticalCritical Secretdist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.js
CriticalSame File Env Network Executiondist/cli/index.js
CriticalCredential Exfiltrationdist/cli/index.js
CriticalDownload Executedist/cli/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli/index.js
CriticalPrevious Version Dangerous Deltadist/cli/index.js
CriticalSecret Patterndist/dashboard/public/assets/chunk-EIO257PC-DnXo63uH.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/systemd-BMfbSWe_.js
HighShelldist/systemd-BMfbSWe_.js
HighCommand Output Exfiltrationdist/cli/index.js
HighSandbox Evasion Gated Capabilitydist/cli/index.js
HighRuntime Package Installdist/cli/index.js
HighShips High Entropy Blobdist/dashboard/public/assets/space-grotesk-latin-ext-400-normal-CfP_5XZW.woff2
HighOversized Source Filedist/dashboard/server.js
HighSecret Patterndist/dashboard/public/assets/chunk-ZUYEQ4TG-B82Qm37l.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/cli/index.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli/index.js
MediumProtestware
MediumShips Build Helperdist/caveman-compress/__init__.py
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings