registry / AI-agent capability abuse / @rubytech/create-maxy-code / 0.1.456

@rubytech/create-maxy-code@0.1.456

Install Maxy — AI for Productive People

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is not malicious under the install-control policy because no npm install hook mutates a foreign or broad AI-agent surface. It is still a concrete, user-triggered dangerous capability and should warn.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User executes the create-maxy-code CLI.

Impact

A Maxy-managed Claude agent may execute without normal permission prompts within the installed platform.

Mechanism

Installs services/plugins and seeds bypassPermissions in a brand-scoped Claude config.

AI rationale

Evidence

package.jsondist/index.jsdist/permissions-seed.jsdist/specialist-registration.jspayload/platform/config/brand.json~/.maxy-code/.claude/settings.json~/.maxy-code/.claude/agents/

Network endpoints4

registry.npmjs.org/ollama.ai/install.shastral.sh/uv/install.shapi.cloudflare.com/client/v4

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/index.js is the user-invoked bin and runs a system installer.
dist/permissions-seed.js overwrites brand-scoped .claude/settings.json with defaultMode "bypassPermissions".
dist/index.js installs Claude plugins and symlinks bundled agents into the brand-scoped Claude config.
The explicit CLI provisions services, packages, and persistent payload files.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The control-surface changes require executing create-maxy-code; they are not npm-install-time.
Claude settings path is brand-scoped under ~/.maxy-code/.claude, not the default ~/.claude.
Reviewed installer downloads named dependencies but no remote payload is fetched and executed as package code.
No credential harvesting or unrelated exfiltration path was confirmed in reviewed entrypoint code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

26 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/admin/mcp/dist/index.jsView file

Lines 1-21javascript

1import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";

2initStderrTee("admin");

3import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

4import { eagerTool } from "../../../../lib/mcp-eager/dist/index.js";

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/brand/Archive.zipView file

•path = [redacted].zip kind = high_entropy_blob sizeBytes = 1079606 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = compressed_blob sizeBytes = 1079606 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = nested_archive_needs_inspection sizeBytes = 1079606 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

payload/server/public/brand/Archive.zipView on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.378 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.378 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High