registry / @rubytech/create-maxy-code / 0.1.455

@rubytech/create-maxy-code@0.1.455

Install Maxy — AI for Productive People

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package is not clean because its explicit installer deliberately establishes persistent, privileged infrastructure and bypasses Claude permission checks. Source inspection does not establish malicious intent or an unconsented install-time control-surface hijack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the `create-maxy-code` bin.

Impact

Can install services/plugins, alter system configuration, and execute downloaded installer scripts.

Mechanism

Persistent platform provisioning with package-scoped Claude permission bypass

AI rationale

Evidence

package.jsondist/index.jsdist/permissions-seed.jsdist/specialist-registration.jspayload/platform/config/brand.json

Network endpoints5

deb.nodesource.com/setup_22.xollama.ai/install.shastral.sh/uv/install.shapi.cloudflare.comgithub.com/cloudflare/cloudflared/releases/download/2026.6.0/

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` is the executable bin and performs a broad system installer workflow.
It downloads and pipes remote installer scripts for Node, Ollama, and uv through `bash`.
It seeds `$HOME/.maxy-code/.claude/settings.json` with Claude `defaultMode: "bypassPermissions"`.
It registers bundled Claude plugins/agents and creates user services, cron entries, and privileged OS configuration.

Evidence against

`package.json` has no install, preinstall, or postinstall lifecycle hook; execution requires the explicit `create-maxy-code` command.
Claude configuration is redirected to package-owned `.maxy-code/.claude`, rather than the user's default `~/.claude`.
Observed endpoints are named vendor/package infrastructure; no source evidence of credential harvesting or unrelated exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork

Source & flagged code

26 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/admin/mcp/dist/index.jsView file

Lines 1-21javascript

1import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";

2initStderrTee("admin");

3import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

4import { eagerTool } from "../../../../lib/mcp-eager/dist/index.js";

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/brand/Archive.zipView file

•path = [redacted].zip kind = high_entropy_blob sizeBytes = 1079606 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = compressed_blob sizeBytes = 1079606 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = nested_archive_needs_inspection sizeBytes = 1079606 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

payload/server/public/brand/Archive.zipView on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.378 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.378 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High