Loading npm security reports…
@rubytech/create-maxy-code@0.1.494: Agent extension lifecycle | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
scanned 3mo ago · by lpm-firewall-ai Source confirms a dangerous user-invoked installer and package-scoped agent permission bypass, not autonomous npm-install-time malware. Warn so the capability is visible without blocking as concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Explicit execution of the create-maxy-code bin (for example via npx).
Impact
Can install software, create services, modify system configuration, and enable bundled agent plugins on the invoking machine.
Mechanism
Remote bootstrap execution, service provisioning, and package-scoped Claude permission/plugin setup.
AI rationale
Source confirms a dangerous user-invoked installer and package-scoped agent permission bypass, not autonomous npm-install-time malware. Warn so the capability is visible without blocking as concrete malicious behavior.
Evidence
package.json dist/index.js dist/permissions-seed.js payload/platform/config/brand.json payload/server/public/brand/Archive.zip ~/.maxy-code/.claude/settings.json ~/.maxy-code/.claude/.claude.json ~/.config/systemd/user ~/maxy-code
Network endpoints6
deb.nodesource.com /setup_22.xollama.ai /install.shastral.sh /uv/install.shdebian.neo4j.com github.com /cloudflare/cloudflared/releases/github.com /ggerganov/whisper.cpp.git
public snapshot AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
dist/index.js executes remote installer scripts via curl|bash. dist/permissions-seed.js sets Claude defaultMode to bypassPermissions. dist/index.js installs Claude marketplaces/plugins and starts persistent services. Evidence against
package.json has no preinstall/install/postinstall hook. Entrypoint runs only when the create-maxy-code CLI is explicitly invoked. Claude settings are scoped to ~/.maxy-code/.claude, not the default ~/.claude. Archive.zip contains brand image assets only. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell
Supply chain HighEntropyStrings Minified Obfuscated Protestware Telemetry UrlStrings
Manifest
21 flagged · loading source payload/platform/scripts/smoke-boot-services.sh View file 335 patternName = generic_password
severity = medium
line = 335
matchedText = local ne...:-}"
Medium Secret Pattern
Package contains a possible secret pattern.
payload/platform/scripts/smoke-boot-services.sh View on unpkg · L335 141 for (const host of ["registry.npmjs.org", "github.com"]) {
L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`);
...
L148: "--connect-timeout", "10",
L149: "https://registry.npmjs.org/",
L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });
...
L155: function captureNpmDebugLog() {
L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");
L157: if (!existsSync(logsDir))
Critical Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.js View on unpkg · L141 3 Critical 13 High 9 Medium 10 Low
Critical Same File Env Network Execution dist/index.js
Critical Download Execute dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
High Child Process dist/index.js
High Shell dist/index.js
High Loopback Host Fingerprint Telemetry dist/index.js
High Sandbox Evasion Gated Capability dist/index.js
High Cross File Remote Execution Context payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js
High Runtime Package Install dist/index.js
High Ships High Entropy Blob payload/server/public/brand/Archive.zip
High Payload In Excluded Dir payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
Affected versions and remediation This report applies to @rubytech/create-maxy-code@0.1.494 .
See all versions of @rubytech/create-maxy-code for other recorded verdicts.
Review the evidence and your use of @rubytech/create-maxy-code@0.1.494 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-07-23 09:47:45.605Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
scanned 862 file(s), 13.2 MB of source, external domains: 0.0.0.0, 127.0.0.1, accounts.google.com, api.anthropic.com, api.cloudflare.com, api.replicate.com, api.telegram.org, appcenter.intuit.com, astral.sh, brew.sh, chevrotain.io, claude.ai, deb.nodesource.com, debian.neo4j.com, dl.google.com, docs.getmaxy.com, docs.realagent.network, en.wikipedia.org, fonts.googleapis.com, fonts.gstatic.com, getmaxy.com, github.com, graph.microsoft.com, langium.org, llmstxt.org, login.microsoftonline.com, maxy.bot, maxy.setup, ns.adobe.com, oauth.platform.intuit.com, oauth2.googleapis.com, ollama.ai, one.dash.cloudflare.com, platform.claude.com, player.vimeo.com, quickbooks.api.intuit.com, react.dev, registry.npmjs.org, sandbox-quickbooks.api.intuit.com, schema.org, www.anthropic.com, www.googleapis.com, www.linkedin.com, www.w3.org, www.xfa.org, www.youtube-nocookie.com
1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Critical Download Execute
Source downloads or fetches remote code and executes it.
dist/index.js View on unpkg · L1 1 Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERS
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 536 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
L537: // composition runs through bash -c so the curl|gpg pipeline is one
L538: // privileged command rather than two separate sudo escalations.
1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High Loopback Host Fingerprint Telemetry
Source collects a broad local host fingerprint and posts it to a fixed loopback listener.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.js View on unpkg · L1 284 function canSudo() {
L285: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
L286: return result.status === 0;
...
L288: /** True when the npm global prefix's node_modules dir is writable by the current
L289: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
L290: function npm[redacted]() {
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.js View on unpkg · L284 • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = dist/index.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.js View on unpkg · L1 payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js View file 29 Cross-file remote execution chain: [redacted]-due-events.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L29: import { chooseDispatchMode, dispatchAgentTurn, runStandingAudit, auditSelfCancels } from "./agent-turn-dispatch.js";
L30: import { spawn } from "node:child_process";
L31: import { shouldRunSentSweep, SENT_SWEEP_INTERVAL_MS, } from "../lib/sent-sweep-throttle.js";
...
L36: function resolveConfigDir() {
L37: const platformRoot = process.env.PLATFORM_ROOT;
L38: if (!platformRoot) {
...
L45: try {
L46: const brand = JSON.parse(readFileSync(brandPath, "utf-8"));
L47: if (!brand.configDir) {
...
L58: }
L59: const CONFIG_DIR = resolve(homedir(), resolveConfigDir());
L60: // ---------------------------------------------------------------------------
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js View on unpkg · L29 payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh View file • path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
kind = payload_in_excluded_dir
sizeBytes = 936
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh View on unpkg • path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
kind = build_helper
sizeBytes = 936
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh View on unpkg payload/server/public/brand/Archive.zip View file • path = [redacted].zip
kind = high_entropy_blob
sizeBytes = 1079606
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
payload/server/public/brand/Archive.zip View on unpkg • path = [redacted].zip
kind = compressed_blob
sizeBytes = 1079606
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
payload/server/public/brand/Archive.zip View on unpkg • path = [redacted].zip
kind = nested_archive_needs_inspection
sizeBytes = 1079606
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
payload/server/public/brand/Archive.zip View on unpkg payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = [redacted].js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js View on unpkg payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = [redacted]-read-attachment.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js View on unpkg • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = dist/brew-install.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/brew-install.js View on unpkg payload/platform/plugins/url-get/mcp/dist/lib/summarise.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = payload/platform/plugins/url-get/mcp/dist/lib/summarise.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/url-get/mcp/dist/lib/summarise.js View on unpkg High Known Malware Source Similarity dist/index.js
High Known Malware Source Similarity payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js
High Known Malware Source Similarity payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js
High Known Malware Source Similarity dist/brew-install.js
High Known Malware Source Similarity payload/platform/plugins/url-get/mcp/dist/lib/summarise.js
Medium Secret Pattern payload/platform/scripts/smoke-boot-services.sh
Medium Install Persistence dist/index.js
Medium Ships Build Helper payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
Medium Ships Compressed Blob payload/server/public/brand/Archive.zip
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Nested Archive Needs Inspection payload/server/public/brand/Archive.zip
node >=22.6.0
Artifact 31.2 MB · 4,478 files 1 signature(s)
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell HighEntropyStrings Minified Obfuscated Protestware Telemetry UrlStrings NoLicense
21 flagged payload/platform/scripts/smoke-boot-services.sh View file Lines 315-355 shell
315 local required = "${ SMOKE_CYPHER_SCHEMA :- optional }"
317 skip_msg () { # $1=reason
318 if [ " $required " = "required" ]; then
319 echo "[smoke-boot] cypher-schema=fail err= $1 (SMOKE_CYPHER_SCHEMA=required)" >&2
322 echo "[smoke-boot] cypher-schema=skip reason= $1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"
326 if ! command -v cypher-shell > /dev/null 2>&1 ; then
327 skip_msg cypher-shell-not-on-path ; return $?
330 if [ -z "${ NEO4J_URI :- }" ]; then
331 skip_msg neo4j-uri-unset ; return $?
334 local neo4j_user = "${ NEO4J_USER :- neo4j }"
335 local neo4j_password = "${ NEO4J_PASSWORD :- }"
Medium Secret Pattern
Package contains a possible secret pattern.
payload/platform/scripts/smoke-boot-services.sh View on unpkg · L335 336 if [ -z " $neo4j_password " ]; then
337 # Fall back to the same password-file convention seed-neo4j.sh uses.
338 local pw_file = " $REPO_ROOT /platform/config/.neo4j-password"
339 if [ -f " $pw_file " ]; then
340 neo4j_password = "$( cat " $pw_file ")"
343 if [ -z " $neo4j_password " ]; then
344 skip_msg neo4j-password-unset ; return $?
347 # Live probe: if the credentials don't authenticate, the check would fail
348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip
349 # rather than fail so the maintainer's own install's Neo4j — whose password
350 # they own — can't block publish.
351 if ! cypher-shell -u " $neo4j_user " -p " $neo4j_password " -a " $NEO4J_URI " \
352 --non-interactive "RETURN 1" > /dev/null 2>&1 ; then
353 skip_msg neo4j-auth-failed ; return $?
141 for (const host of ["registry.npmjs.org", "github.com"]) {
L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`);
...
L148: "--connect-timeout", "10",
L149: "https://registry.npmjs.org/",
L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });
...
L155: function captureNpmDebugLog() {
L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");
L157: if (!existsSync(logsDir))
Critical Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.js View on unpkg · L141 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Critical Download Execute
Source downloads or fetches remote code and executes it.
dist/index.js View on unpkg · L1 payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js View file 29 Cross-file remote execution chain: [redacted]-due-events.js spawns dist/index.js; helper contains network access plus dynamic code execution.
L29: import { chooseDispatchMode, dispatchAgentTurn, runStandingAudit, auditSelfCancels } from "./agent-turn-dispatch.js";
L30: import { spawn } from "node:child_process";
L31: import { shouldRunSentSweep, SENT_SWEEP_INTERVAL_MS, } from "../lib/sent-sweep-throttle.js";
...
L36: function resolveConfigDir() {
L37: const platformRoot = process.env.PLATFORM_ROOT;
L38: if (!platformRoot) {
...
L45: try {
L46: const brand = JSON.parse(readFileSync(brandPath, "utf-8"));
L47: if (!brand.configDir) {
...
L58: }
L59: const CONFIG_DIR = resolve(homedir(), resolveConfigDir());
L60: // ---------------------------------------------------------------------------
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js View on unpkg · L29 payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh View file • path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
kind = payload_in_excluded_dir
sizeBytes = 936
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh View on unpkg • path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
kind = build_helper
sizeBytes = 936
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh View on unpkg payload/server/public/brand/Archive.zip View file • path = [redacted].zip
kind = high_entropy_blob
sizeBytes = 1079606
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
payload/server/public/brand/Archive.zip View on unpkg • path = [redacted].zip
kind = compressed_blob
sizeBytes = 1079606
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
payload/server/public/brand/Archive.zip View on unpkg • path = [redacted].zip
kind = nested_archive_needs_inspection
sizeBytes = 1079606
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
payload/server/public/brand/Archive.zip View on unpkg payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = [redacted].js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js View on unpkg payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = [redacted]-read-attachment.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js View on unpkg • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = dist/brew-install.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/brew-install.js View on unpkg payload/platform/plugins/url-get/mcp/dist/lib/summarise.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = payload/platform/plugins/url-get/mcp/dist/lib/summarise.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/url-get/mcp/dist/lib/summarise.js View on unpkg Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERS
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 536 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
L537: // composition runs through bash -c so the curl|gpg pipeline is one
L538: // privileged command rather than two separate sudo escalations.
1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High Loopback Host Fingerprint Telemetry
Source collects a broad local host fingerprint and posts it to a fixed loopback listener.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.js View on unpkg · L1 284 function canSudo() {
L285: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
L286: return result.status === 0;
...
L288: /** True when the npm global prefix's node_modules dir is writable by the current
L289: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
L290: function npm[redacted]() {
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.js View on unpkg · L284 • matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = dist/index.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.js View on unpkg · L1