registry / Data exfiltration / @remixhq/cli
@remixhq/cli
Remix CLI tooling
This report shows the evidence for @remixhq/cli@0.1.63. 1 of 3 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install lifecycle hook, but its normal collab init command silently starts a background collector that overrides an explicit privacy default and uploads local AI transcript content. This is concrete, unconsented data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs remix collab init for an eligible repository without an existing import marker.
Impact
Private Claude Code and Cursor conversation text, including assistant responses, can leave the machine without a separate consent step.
Mechanism
Detached transcript collection and remote upload with forced prompt-text inclusion.
Attack narrative
After a user invokes collab init, the CLI conditionally starts a detached history-import child process. That child is given --include-prompt-text despite the normal history import command declaring prompt forwarding off by default. It scans local Claude Code transcripts and Cursor state, builds records containing prompt and assistant text, and posts them to the configured Remix API history endpoint. The automatic background transfer of private AI transcripts is concrete data exfiltration.
AI rationale
The package has no install lifecycle hook, but its normal collab init command silently starts a background collector that overrides an explicit privacy default and uploads local AI transcript content. This is concrete, unconsented data exfiltration.
Evidence
dist/cli.cjs.claude/projectsLibrary/Application Support/Cursor/User/globalStorage/state.vscdb~/.remix/collab-state/history-import
Network endpoints1
api.remix.one/v1/history/import
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The collab init command automatically starts a detached history-import process when no marker exists.
- The spawned process forcibly enables prompt-text inclusion even though the manual history command says that option is off by default.
- The importer reads Claude transcript directories and the local Cursor database, then includes prompt and assistant text in records.
- Those records are posted to the Remix API history-import endpoint.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The automatic collection is reached through the user-invoked collab init command, not package installation.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStrings
Source & flagged code
11 flagged · loading sourcedist/cli.cjsView file
43* Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L1204: var EventEmitter2 = require("events").EventEmitter;
L1205: var childProcess = require("child_process");
L1206: var path46 = require("path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process10.stdout.write(str),
L1256: writeErr: (str) => process10.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/cli.cjsView on unpkg · L4343Trigger-reachable chain: manifest.bin -> dist/cli.cjs
L43: * Constructs the CommanderError class
L44: * @param {number} exitCode suggested exit code which could be used with process.exit
L45: * @param {string} code an id string representing the error
...
L1204: var EventEmitter2 = require("events").EventEmitter;
L1205: var childProcess = require("child_process");
L1206: var path46 = require("path");
...
L1254: this._outputConfiguration = {
L1255: writeOut: (str) => process10.stdout.write(str),
L1256: writeErr: (str) => process10.stderr.write(str),
...
L1296: * @returns {Command[]}
L1297: * @private
L1298: */
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.cjsView on unpkg · L43Findings
2 Critical8 High3 Medium3 Low
CriticalCredential Exfiltrationdist/cli.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/cli.cjs
HighChild Processdist/cli.cjs
HighEvaldist/cli.cjs
HighCredential Redirect Persistencedist/cli.cjs
HighObfuscated Payload Loaderdist/cli.cjs
HighTrigger Reachable Credential Exfiltrationdist/cli.cjs
HighTrigger Reachable External Post Callbackdist/cli.cjs
HighRuntime Package Installdist/cli.cjs
HighSemantic Analysis Limiteddist/cli.cjs
MediumDynamic Requiredist/cli.cjs
MediumEnvironment Vars
Affected versions and remediation
This report applies to @remixhq/cli@0.1.63.
The versions list below shows the verdict for each recorded version.
- Avoid installing @remixhq/cli@0.1.63. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.