Loading npm security reports…

@rubytech/create-maxy-code: AI-agent control-surface risk | LPM Firewall

registry / @rubytech/create-maxy-code / 0.1.632

@rubytech/create-maxy-code@0.1.632

Install Maxy — AI for Productive People

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Running the package's CLI changes Claude Code's permission and workspace-trust controls, then installs plugins in user scope. This creates an unattended agent environment that can act without normal approval prompts.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The user invokes the create-maxy-code command.

Impact

Claude sessions associated with the installed Maxy environment can bypass permission prompts and trust checks.

Mechanism

Seeds bypass-permission and trusted-workspace settings, then registers and installs Claude plugins.

Policy narrative

The package has no registry install hook, but its executable installer creates a dedicated Claude configuration, writes defaultMode bypassPermissions, marks workspaces trusted, and installs plugins at user scope. These changes intentionally suppress Claude's user approval and workspace-trust safeguards while deploying a large agent platform. No separate secret-exfiltration path was required to establish the harmful control-surface change.

Rationale

The explicit CLI trigger lowers accidental-install risk, but the source directly disables Claude permission checks and accepts workspace trust before installing agent plugins. That is a concrete agent-control permission bypass and warrants blocking.

Evidence

package.jsondist/index.jsdist/permissions-seed.jsdist/claude-trust-seed.jspayload/platform/config/brand.json

Decision evidence

Source & flagged code

17 flagged · loading source

payload/platform/scripts/smoke-boot-services.shView file

349patternName = generic_password severity = medium line = 349 matchedText = local ne...:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L349

dist/index.jsView file

142for (const host of ["registry.npmjs.org", "github.com"]) { L143: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 }); L144: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`); ... L149: "--connect-timeout", "10", L150: "https://registry.npmjs.org/", L151: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 }); ... L156: function captureNpmDebugLog() { L157: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs"); L158: if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L142

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L52: } L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L52: } L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L54: const PERS

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

537// Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe L538: // composition runs through bash -c so the curl|gpg pipeline is one L539: // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L537

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... "https://registry.npmjs.org/", /** True when the npm global prefix's node_modules dir is writable by the current accessSync(join(prefix, "lib", "node_modules"), fsConstants.W_OK); "curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | " + * write (writeFileSync overwrites in place). writeFileSync(target, RESOLVED_CHROMIUM_BIN + "\n", { mode: 0o644 }); writeFileSync(target, formatWebsockifyBindFile(decision), { mode: 0o644 });

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L52: } L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L52: } L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L54

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/index.jsView on unpkg · L1

285function canSudo() { L286: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 }); L287: return result.status === 0; ... L289: /** True when the npm global prefix's node_modules dir is writable by the current L290: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */ L291: function npm[redacted]() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L285

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L52: } L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

payload/platform/plugins/memory/mcp/scripts/graph/accept.shView file

20Cross-file remote execution chain: [redacted].sh spawns dist/index.js; helper contains network access plus dynamic code execution. L20: # L21: # Exit codes: L22: # 0 all PASS ... L36: if ! command -v uvx >/dev/null 2>&1; then L37: echo "FAIL: uvx not on PATH — run: curl -LsSf https://astral.sh/uv/install.sh | sh -s -- -y" >&2 L38: exit 2 ... L64: node -e " L65: const { spawn } = require('node:child_process'); L66: const proc = spawn('node', [process.env.SHIM], { stdio: ['pipe', 'pipe', 'inherit'] }); L67: let buf = ''; L68: proc.stdout.on('data', (chunk) => { buf += chunk.toString('utf8'); }); L69: const send = (obj) => proc.stdin.write(JSON.stringify(obj) + '\n');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

payload/platform/plugins/memory/mcp/scripts/graph/accept.shView on unpkg · L20

payload/platform/plugins/memory/bin/conversation-archive-ingest.shView file

•path = [redacted]-archive-ingest.sh kind = build_helper sizeBytes = 4369 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/memory/bin/conversation-archive-ingest.shView on unpkg

payload/server/public/assets/graph-labels-BTFUSc63.js.gzView file

•path = [redacted]-labels-BTFUSc63.js.gz kind = high_entropy_blob sizeBytes = 9968 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/graph-labels-BTFUSc63.js.gzView on unpkg

•path = [redacted]-labels-BTFUSc63.js.gz kind = compressed_blob sizeBytes = 9968 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/assets/graph-labels-BTFUSc63.js.gzView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-read-attachment.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

dist/brew-install.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/brew-install.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

Source & flagged code

17 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 329-369shell

329 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

330

331 skip_msg() { # $1=reason

332 if [ "$required" = "required" ]; then

333 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

334 return 1

335 fi

336 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

337 return 0

338 }

339

340 if ! command -v cypher-shell >/dev/null 2>&1; then

341 skip_msg cypher-shell-not-on-path; return $?

342 fi

343

344 if [ -z "${NEO4J_URI:-}" ]; then

345 skip_msg neo4j-uri-unset; return $?

346 fi

347

348 local neo4j_user="${NEO4J_USER:-neo4j}"

349 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L349

350 if [ -z "$neo4j_password" ]; then

351 # Fall back to the same password-file convention seed-neo4j.sh uses.

352 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

353 if [ -f "$pw_file" ]; then

354 neo4j_password="$(cat "$pw_file")"

355 fi

356 fi

357 if [ -z "$neo4j_password" ]; then

358 skip_msg neo4j-password-unset; return $?

359 fi

360

361 # Live probe: if the credentials don't authenticate, the check would fail

362 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

363 # rather than fail so the maintainer's own install's Neo4j — whose password

364 # they own — can't block publish.

365 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

366 --non-interactive "RETURN 1" >/dev/null 2>&1; then

367 skip_msg neo4j-auth-failed; return $?

368 fi

369

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/memory/mcp/scripts/graph/accept.shView file

Lines 1-40shell

1#!/usr/bin/env bash

2# Acceptance harness for the graph MCP integration.

3#

4# Spawns the graph shim, drives it as a JSON-RPC client over stdio, runs

5# one query per acceptance class, prints PASS/FAIL per check, and exits

6# non-zero if any check fails. Assumes the brand's Neo4j is running and

7# the fixture in fixture.cypher has been seeded.

8#

9# The tools/list assertion guards against FastMCP-joiner drift: the

10

payload/platform/plugins/memory/bin/conversation-archive-ingest.shView file

•path = [redacted]-archive-ingest.sh kind = build_helper sizeBytes = 4369 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/memory/bin/conversation-archive-ingest.shView on unpkg

payload/server/public/assets/graph-labels-BTFUSc63.js.gzView file

•path = [redacted]-labels-BTFUSc63.js.gz kind = high_entropy_blob sizeBytes = 9968 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/graph-labels-BTFUSc63.js.gzView on unpkg

•path = [redacted]-labels-BTFUSc63.js.gz kind = compressed_blob sizeBytes = 9968 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/assets/graph-labels-BTFUSc63.js.gzView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-read-attachment.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

dist/brew-install.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/brew-install.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

Lines 122-162javascript

122const _log = console.log;

123const _err = console.error;

124console.log = (...args) => { _log(...args); logFile(args.map(String).join(" ")); };

125console.error = (...args) => { _err(...args); logFile(`[ERROR] ${args.map(String).join(" ")}`); };

126// ---------------------------------------------------------------------------

127// Diagnostics — system state snapshot for post-mortem analysis

128// ---------------------------------------------------------------------------

129function logDiagnostics(label) {

130 logFile(`\n--- Diagnostics: ${label} ---`);

131 if (!isLinux()) {

132 logFile(" (not Linux — limited diagnostics)");

133 return;

134 }

135 const run = (cmd, args) => {

136 const r = spawnSync(cmd, args, { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });

137 return (r.stdout || r.stderr || "").trim();

138 };

139 logFile(`Disk:\n${run("df", ["-h", "/", "/tmp"])}`);

140 logFile(`Memory:\n${run("free", ["-h"])}`);

141 logFile(`Uptime: ${run("uptime", [])}`);

142 for (const host of ["registry.npmjs.org", "github.com"]) {

143 const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });

144 logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").

145 }

146 const curl = spawnSync("curl", [

147 "-sf", "-o", "/dev/null",

148 "-w", "HTTP %{http_code} in %{time_total}s (dns: %{time_namelookup}s, connect: %{time_connect}s)",

149 "--connect-timeout", "10",

150 "https://registry.npmjs.org/",

151 ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });

152 logFile(`Registry HTTP: ${curl.stdout?.trim() || `FAIL — ${curl.stderr?.trim()}`}`);

153 logFile(`--- End Diagnostics ---\n`);

154}

155/** Append the most recent npm debug log into our install log for post-mortem. */

156function captureNpmDebugLog() {

157 const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");

158 if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L142

159 return;

160 try {

161 const files = readdirSync(logsDir).filter(f => f.endsWith("-debug-0.log")).sort().reverse();

162 if (files[0]) {

Lines 517-557javascript

517 catch {

518 return null;

519 }

520 };

521 const whichChromium = which("chromium");

522 const whichGoogleChrome = which("google-chrome-stable");

523 const decision = decideChromiumAction({

524 platform: "linux",

525 whichChromium,

526 realpathChromium: realpath(whichChromium),

527 whichGoogleChrome,

528 realpathGoogleChrome: realpath(whichGoogleChrome),

529 });

530 logFile(` [snap-chromium] decision: ${decision.action} reason="${decision.reason}"`);

531 if (decision.action === "fail") {

532 throw new Error(`ensureNonSnapChromium: ${decision.reason}. apt install of \`chromium\` ran in installAptGroup(VNC stack) above; if its post-check passed but no chromium binary is on PATH, the system PATH is misconfigured.`);

533 }

534 if (decision.action === "install-google-chrome") {

535 console.log(" Detected snap-confined Chromium — installing Google Chrome stable...");

536 logFile(` [snap-chromium] installing google-chrome-stable from Google's signed apt repo`);

537 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe

538 // composition runs through bash -c so the curl|gpg pipeline is one

539 // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L537

540 console.log(" [privileged] curl + gpg --dearmor (Google Chrome signing key)");

541 shell("bash", ["-c",

542 "set -euo pipefail; " +

543 "curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | " +

544 "gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/google-chrome.gpg",

545 ], { sudo: true });

546 // Add the apt source list with `signed-by=` scoping so the key only

547 // verifies google-chrome-* packages, not arbitrary repo overrides. arch

548 // pinned to amd64 — Google does not ship arm64 Chrome for Linux.

549 console.log(" [privileged] tee /etc/apt/sources.list.d/google-chrome.list");

550 shell("bash", ["-c",

551 "echo 'deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/google-chrome.gpg] " +

552 "http://dl.google.com/linux/chrome/deb/ stable main' " +

553 "> /etc/apt/sources.list.d/google-chrome.list",

554 ], { sudo: true });

555 console.log(" [privileged] apt-get update");

556 shell("apt-get", ["update"], { sudo: true });

557 installAptGroup("Google Chrome stable", ["google-chrome-stable"]);