Loading npm security reports…

@remixhq/cli@0.1.63: Malicious npm security report (Block) | LPM Firewall

registry / @remixhq/cli / 0.1.63

@remixhq/cli@0.1.63

Remix CLI tooling

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Running remix collab init can silently launch a detached process that collects and uploads local AI conversation content. The spawned path overrides the command's normal prompt-text opt-in.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs remix collab init for an eligible repository without an existing import marker.

Impact

Private Claude Code and Cursor conversation text, including assistant responses, can leave the machine without a separate consent step.

Mechanism

Detached transcript collection and remote upload with forced prompt-text inclusion.

Attack narrative

After a user invokes collab init, the CLI conditionally starts a detached history-import child process. That child is given --include-prompt-text despite the normal history import command declaring prompt forwarding off by default. It scans local Claude Code transcripts and Cursor state, builds records containing prompt and assistant text, and posts them to the configured Remix API history endpoint. The automatic background transfer of private AI transcripts is concrete data exfiltration.

Rationale

The package has no install lifecycle hook, but its normal collab init command silently starts a background collector that overrides an explicit privacy default and uploads local AI transcript content. This is concrete, unconsented data exfiltration.

Evidence

dist/cli.cjs.claude/projectsLibrary/Application Support/Cursor/User/globalStorage/state.vscdb~/.remix/collab-state/history-import

Network endpoints1

/v1/history/import

Source & flagged code

11 flagged · loading source

dist/cli.cjsView file

43* Constructs the CommanderError class L44: * @param {number} exitCode suggested exit code which could be used with process.exit L45: * @param {string} code an id string representing the error ... L1204: var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path"); ... L1254: this._outputConfiguration = { L1255: writeOut: (str) => process10.stdout.write(str), L1256: writeErr: (str) => process10.stderr.write(str), ... L1296: * @returns {Command[]} L1297: * @private L1298: */

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.cjsView on unpkg · L43

43Trigger-reachable chain: manifest.bin -> dist/cli.cjs L43: * Constructs the CommanderError class L44: * @param {number} exitCode suggested exit code which could be used with process.exit L45: * @param {string} code an id string representing the error ... L1204: var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path"); ... L1254: this._outputConfiguration = { L1255: writeOut: (str) => process10.stdout.write(str), L1256: writeErr: (str) => process10.stderr.write(str), ... L1296: * @returns {Command[]} L1297: * @private L1298: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.cjsView on unpkg · L43

1204var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path");

High

Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L1204

83546try { L83547: const dn = globalThis.__dirname ?? eval("typeof __dirname !== 'undefined' ? __dirname : null"); L83548: if (dn) seeds.add(dn);

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L83546

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: await fh.writeFile(`${process.pid} var fs$writeFile = fs36.writeFile; fs36.writeFile = writeFile2; function writeFile2(path46, data, options, cb) { return go$writeFile(path46, data, options, cb); function go$writeFile(path47, data2, options2, cb2, startTime) { return fs$writeFile(path47, data2, options2, function(err) { enqueue([go$writeFile, [path47, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

8995if (!fs35[gracefulQueue]) { L8996: queue2 = global[gracefulQueue] || []; L8997: publishQueue(fs35, queue2);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L8995

43Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.cjs L43: * Constructs the CommanderError class L44: * @param {number} exitCode suggested exit code which could be used with process.exit L45: * @param {string} code an id string representing the error ... L1204: var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path"); ... L1254: this._outputConfiguration = { L1255: writeOut: (str) => process10.stdout.write(str), L1256: writeErr: (str) => process10.stderr.write(str), ... L1296: * @returns {Command[]} L1297: * @private L1298: */

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.cjsView on unpkg · L43

•Trigger-reachable fixed external POST callback chain: manifest.bin -> dist/cli.cjs `choices: ${option.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}` `default: ${option.defaultValueDescription || JSON.stringify(option.defaultValue)}` extraInfo.push(`preset: ${JSON.stringify(option.presetArg)}`); `choices: ${argument.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}` `default: ${argument.defaultValueDescription || JSON.stringify(argument.defaultValue)}` writeOut: (str) => process10.stdout.write(str), writeErr: (str) => process10.stderr.write(str), outputError: (str, write) => write(str),

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/cli.cjsView on unpkg

65989log2(import_picocolors6.default.dim("Running Expo prebuild...")); L65990: const prebuild = await execa("npx", ["expo", "prebuild"], { cwd: stagingPath, stdio: params.json ? "ignore" : "inherit" }); L65991: if (prebuild.exitCode !== 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.cjsView on unpkg · L65989

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.cjsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.cjsView on unpkg · L11

Source & flagged code

11 flagged

dist/cli.cjsView file

43* Constructs the CommanderError class L44: * @param {number} exitCode suggested exit code which could be used with process.exit L45: * @param {string} code an id string representing the error ... L1204: var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path"); ... L1254: this._outputConfiguration = { L1255: writeOut: (str) => process10.stdout.write(str), L1256: writeErr: (str) => process10.stderr.write(str), ... L1296: * @returns {Command[]} L1297: * @private L1298: */

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.cjsView on unpkg · L43

43Trigger-reachable chain: manifest.bin -> dist/cli.cjs L43: * Constructs the CommanderError class L44: * @param {number} exitCode suggested exit code which could be used with process.exit L45: * @param {string} code an id string representing the error ... L1204: var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path"); ... L1254: this._outputConfiguration = { L1255: writeOut: (str) => process10.stdout.write(str), L1256: writeErr: (str) => process10.stderr.write(str), ... L1296: * @returns {Command[]} L1297: * @private L1298: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.cjsView on unpkg · L43

1204var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path");

High

Child Process

Package source references child process execution.

dist/cli.cjsView on unpkg · L1204

83546try { L83547: const dn = globalThis.__dirname ?? eval("typeof __dirname !== 'undefined' ? __dirname : null"); L83548: if (dn) seeds.add(dn);

High

Eval

Package source references dynamic code evaluation.

dist/cli.cjsView on unpkg · L83546

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.cjs: await fh.writeFile(`${process.pid} var fs$writeFile = fs36.writeFile; fs36.writeFile = writeFile2; function writeFile2(path46, data, options, cb) { return go$writeFile(path46, data, options, cb); function go$writeFile(path47, data2, options2, cb2, startTime) { return fs$writeFile(path47, data2, options2, function(err) { enqueue([go$writeFile, [path47, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.cjsView on unpkg

8995if (!fs35[gracefulQueue]) { L8996: queue2 = global[gracefulQueue] || []; L8997: publishQueue(fs35, queue2);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/cli.cjsView on unpkg · L8995

43Trigger-reachable credential exfiltration chain: manifest.bin -> dist/cli.cjs L43: * Constructs the CommanderError class L44: * @param {number} exitCode suggested exit code which could be used with process.exit L45: * @param {string} code an id string representing the error ... L1204: var EventEmitter2 = require("events").EventEmitter; L1205: var childProcess = require("child_process"); L1206: var path46 = require("path"); ... L1254: this._outputConfiguration = { L1255: writeOut: (str) => process10.stdout.write(str), L1256: writeErr: (str) => process10.stderr.write(str), ... L1296: * @returns {Command[]} L1297: * @private L1298: */

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/cli.cjsView on unpkg · L43

•Trigger-reachable fixed external POST callback chain: manifest.bin -> dist/cli.cjs `choices: ${option.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}` `default: ${option.defaultValueDescription || JSON.stringify(option.defaultValue)}` extraInfo.push(`preset: ${JSON.stringify(option.presetArg)}`); `choices: ${argument.argChoices.map((choice) => JSON.stringify(choice)).join(", ")}` `default: ${argument.defaultValueDescription || JSON.stringify(argument.defaultValue)}` writeOut: (str) => process10.stdout.write(str), writeErr: (str) => process10.stderr.write(str), outputError: (str, write) => write(str),

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/cli.cjsView on unpkg

65989log2(import_picocolors6.default.dim("Running Expo prebuild...")); L65990: const prebuild = await execa("npx", ["expo", "prebuild"], { cwd: stagingPath, stdio: params.json ? "ignore" : "inherit" }); L65991: if (prebuild.exitCode !== 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.cjsView on unpkg · L65989

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.cjsView on unpkg

11}; L12: var __commonJS = (cb, mod) => function __require() { L13: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.cjsView on unpkg · L11