registry / @rubytech/create-maxy-code / 0.1.471

@rubytech/create-maxy-code@0.1.471

Install Maxy — AI for Productive People

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Legitimate first-party, user-invoked installer with no install hooks, no exfiltration, and only official upstream endpoints, so the scanner's malicious verdict is a false positive. It does seed bypassPermissions into its own agent config and broadly mutates the host, a guarded first-party agent-extension lifecycle risk warranting warn, not block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

User explicitly runs the bin via `npx create-maxy-code` (no npm install lifecycle hook).

Impact

Weakens its own branded agent's permission guardrails (bypassPermissions) and broadly modifies the host system during user-invoked setup.

Mechanism

System provisioning installer (spawnSync apt/curl|sh, systemd/launchd units) plus first-party agent permission seeding.

AI rationale

Evidence

package.jsondist/index.jsdist/permissions-seed.js<HOME>/<brand.configDir>/.claude/settings.json

Network endpoints7

dl.google.comdeb.nodesource.comdebian.neo4j.comollama.aiastral.shgithub.com/cloudflare/cloudflaredregistry.npmjs.org

Decision evidence

public snapshot

AI called this Suspicious at 80.0% confidence as Benign with medium false-positive risk.

Evidence for warning

dist/permissions-seed.js seeds Claude Code defaultMode:'bypassPermissions' + autoMode trust block into brand config dir
dist/index.js broadly mutates system: sudo apt, systemd/launchd units, file immutability (install-immutability.js)
Multiple curl|sh upstream installers executed (ollama.ai, astral.sh/uv, nodesource)

Evidence against

No preinstall/install/postinstall hooks; only prepublishOnly (publisher-side) and a user-invoked bin (npx create-maxy-code)
All network endpoints are official upstreams: dl.google.com, deb.nodesource.com, debian.neo4j.com, ollama.ai, astral.sh, github.com/cloudflare
No credential/env exfiltration; 'password' refs are locally-generated randomBytes Neo4j creds set on local DB
bypassPermissions targets package's OWN brand-scoped CLAUDE_CONFIG_DIR (PERSIST_DIR/.claude), not user global ~/.claude
autoMode block retains '$defaults' and states Data Exfiltration hard block still applies
Archive.zip/test.sh are brand assets and test fixtures in payload/

Behavioral surface

Source

ChildProcess

Source & flagged code

26 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

Lines 8-48javascript

8 * 2. Every compiled tool module loads without throwing.

9 * 3. Every exported handler is a function

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/brand/Archive.zipView file

•path = [redacted].zip kind = high_entropy_blob sizeBytes = 1079606 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = compressed_blob sizeBytes = 1079606 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/brand/Archive.zipView on unpkg

•path = [redacted].zip kind = nested_archive_needs_inspection sizeBytes = 1079606 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

payload/server/public/brand/Archive.zipView on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-read-attachment.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-availability.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/brew-install.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Source & flagged code

26 flagged · loading source

payload/platform/scripts/smoke-boot-services.shView file

335patternName = generic_password severity = medium line = 335 matchedText = local ne...:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

dist/index.jsView file

141for (const host of ["registry.npmjs.org", "github.com"]) { L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 }); L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`); ... L148: "--connect-timeout", "10", L149: "https://registry.npmjs.org/", L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 }); ... L155: function captureNpmDebugLog() { L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs"); L157: if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L141

Findings

3 Critical12 High15 Medium10 Low

CriticalSame File Env Network Executiondist/index.js

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextpayload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjs

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobpayload/server/public/brand/Archive.zip

HighPayload In Excluded Dirpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh

High

Affected versions and remediation

This report applies to @rubytech/create-maxy-code@0.1.471.

See all versions of @rubytech/create-maxy-code for other recorded verdicts.

Review the evidence and your use of @rubytech/create-maxy-code@0.1.471 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-24 19:54:28.520Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @rubytech

Behavioral surface

Related packages

More from @rubytech

Source & flagged code