registry / @rubytech/create-maxy-code / 0.1.458

@rubytech/create-maxy-code@0.1.458

Install Maxy — AI for Productive People

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

First-party, user-invoked product installer with no install hooks; download/execute uses official upstreams and the bypassPermissions seed targets the package's own brand config. Seeding skip-all-permission-checks into a Claude Code control surface is a real agent-lifecycle risk warranting warn, but not the unconsented foreign-surface mutation required to block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User runs the create-maxy-code bin CLI (not any install hook)

Impact

Disables Claude Code permission prompts for its own brand config dir, enabling unattended agent operation; elevated AI-agent control surface risk

Mechanism

user-invoked installer seeding own Claude Code permission surface + apt/curl upstream dependency setup

AI rationale

Evidence

package.jsondist/index.jsdist/permissions-seed.js~/.<brand>/.claude/settings.json

Network endpoints7

registry.npmjs.orgdl.google.comdebian.neo4j.comollama.aiastral.shdeb.nodesource.comgithub.com/cloudflare/cloudflared

Decision evidence

public snapshot

AI called this Suspicious at 72.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

permissions-seed.js seeds Claude Code defaultMode:"bypassPermissions" (skip-all-permission-checks) into brand .claude/settings.json
index.js runs official curl|sh installers (ollama.ai, astral.sh/uv, nodesource, cloudflared) — download+execute surface
autoMode block declares install's Cloudflare token mint/persist sanctioned for AI agent
Scanner claims source 'matched previously finalized malicious package' — an unsupported static label vs coherent product installer

Evidence against

No preinstall/install/postinstall hooks; only prepublishOnly (author publish machine) and a user-invoked bin CLI
bypass/autoMode writes target the package's OWN brand config dir, not a foreign/broad surface
autoMode retains "$defaults", keeping built-in exfiltration/force-push/deploy guards
All network fetches are official upstream tooling, package-aligned to installer
No credential harvesting/exfiltration, eval, or hidden remote payload execution found

Behavioral surface

Source

ChildProcessCryptoDynamicRequire

Source & flagged code

26 flagged

payload/platform/scripts/smoke-boot-services.shView file

335patternName = generic_password severity = medium line = 335 matchedText = local ne...:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

dist/index.jsView file

141for (const host of ["registry.npmjs.org", "github.com"]) { L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 }); L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`); ... L148: "--connect-timeout", "10", L149: "https://registry.npmjs.org/", L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 }); ... L155: function captureNpmDebugLog() { L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs"); L157: if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L141

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildHeartbeatCronBlock, mergeHeartbeatBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L51: } L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAN

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildHeartbeatCronBlock, mergeHeartbeatBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L51: } L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L53: const

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

536// Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe L537: // composition runs through bash -c so the curl|gpg pipeline is one L538: // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L536

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

284function canSudo() { L285: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 }); L286: return result.status === 0; ... L288: /** True when the npm global prefix's node_modules dir is writable by the current L289: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */ L290: function npm[redacted]() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L284

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

payload/platform/plugins/admin/mcp/dist/index.jsView file

1Cross-file remote execution chain: [redacted].js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js"; L2: initStderrTee("admin"); ... L8: import { resolve, join } from "node:path"; L9: import { execFile, execFileSync } from "node:child_process"; L10: import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs"; ... L19: import { createHash, randomInt, randomUUID } from "node:crypto"; L20: import { createConnection } from "node:net"; L21: import { homedir, hostname as osHostname } from "node:os"; ... L49: }); L50: const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname, "../../

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

payload/platform/plugins/admin/mcp/dist/index.jsView on unpkg · L1

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/brand/Archive.zipView file

•path = [redacted].zip kind = high_entropy_blob sizeBytes = 1079606 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = compressed_blob sizeBytes = 1079606 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = nested_archive_needs_inspection sizeBytes = 1079606 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

payload/server/public/brand/Archive.zipView on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.378 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.378 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High