registry / AI-agent capability abuse / @rubytech/create-maxy-code / 0.1.521

@rubytech/create-maxy-code@0.1.521

Install Maxy — AI for Productive People

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a high-risk, user-invoked installer with explicit Claude permission-bypass configuration. Its behavior warrants a warning, but source inspection does not establish malicious install-time execution or a concrete covert attack chain.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Explicit execution of `create-maxy-code` after installation.

Impact

Can alter host services and reduce Claude Code interaction safeguards within `~/.maxy-code/.claude`.

Mechanism

user-invoked installer with remote bootstrap, persistence, and AI-agent permission mutation

AI rationale

Evidence

package.jsondist/index.jsdist/permissions-seed.jsdist/specialist-registration.jspayload/platform/config/brand.json~/.maxy-code/.claude/settings.json~/.maxy-code/.claude/.claude.json

Network endpoints5

ollama.ai/install.shastral.sh/uv/install.shdeb.nodesource.com/setup_22.xdebian.neo4j.comgithub.com/cloudflare/cloudflared/releases/download/

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` executes installer logic when its CLI bin is run.
It downloads and pipes scripts to shells from `ollama.ai` and `astral.sh`.
It seeds `~/.maxy-code/.claude/settings.json` with Claude `defaultMode: bypassPermissions`.
It marks the home workspace trusted and installs/registers Claude plugins.
It enables persistent systemd/launchd services and writes system configuration.

Evidence against

`package.json` has no install, preinstall, or postinstall lifecycle hook.
The dangerous actions are reached through the user-invoked `create-maxy-code` CLI, not npm installation.
Remote downloads and service setup are named product dependencies; no credential-exfiltration path was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

Source & flagged code

20 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.jsView file

29Cross-file remote execution chain: [redacted]-due-events.js spawns dist/index.js; helper contains network access plus dynamic code execution. L29: import { chooseDispatchMode, dispatchAgentTurn, runStandingAudit, auditSelfCancels } from "./agent-turn-dispatch.js"; L30: import { spawn } from "node:child_process"; L31: import { shouldRunSentSweep, SENT_SWEEP_INTERVAL_MS, } from "../lib/sent-sweep-throttle.js"; ... L36: function resolveConfigDir() { L37: const platformRoot = process.env.PLATFORM_ROOT; L38: if (!platformRoot) { ... L45: try { L46: const brand = JSON.parse(readFileSync(brandPath, "utf-8")); L47: if (!brand.configDir) { ... L58: } L59: const CONFIG_DIR = resolve(homedir(), resolveConfigDir()); L60: // ---------------------------------------------------------------------------

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

payload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.jsView on unpkg · L29

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 1019 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 1019 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/chunk-CIAEETIT-CpsybR7q.js.gzView file

•path = [redacted]-CIAEETIT-CpsybR7q.js.gz kind = compressed_blob sizeBytes = 352 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

payload/server/public/assets/chunk-CIAEETIT-CpsybR7q.js.gzView on unpkg

payload/server/public/assets/chunk-ICPOFSXX-UPPu2OIq.js.gzView file

•path = [redacted]-ICPOFSXX-UPPu2OIq.js.gz kind = high_entropy_blob sizeBytes = 30652 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/chunk-ICPOFSXX-UPPu2OIq.js.gzView on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-read-attachment.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

dist/brew-install.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/brew-install.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/url-get/mcp/dist/lib/summarise.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = payload/platform/plugins/url-get/mcp/dist/lib/summarise.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/url-get/mcp/dist/lib/summarise.jsView on unpkg

Source & flagged code

20 flagged · loading source

payload/platform/scripts/smoke-boot-services.shView file

335patternName = generic_password severity = medium line = 335 matchedText = local ne...:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

dist/index.jsView file

141for (const host of ["registry.npmjs.org", "github.com"]) { L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 }); L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`); ... L148: "--connect-timeout", "10", L149: "https://registry.npmjs.org/", L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 }); ... L155: function captureNpmDebugLog() { L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs"); L157: if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L141

Findings

3 Critical13 High9 Medium9 Low

CriticalSame File Env Network Executiondist/index.js

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighLoopback Host Fingerprint Telemetrydist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextpayload/platform/plugins/scheduling/mcp/dist/scripts/check-due-events.js

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobpayload/server/public/assets/chunk-ICPOFSXX-UPPu2OIq.js.gz

HighPayload In Excluded Dirpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh

Affected versions and remediation

This report applies to @rubytech/create-maxy-code@0.1.521.

See all versions of @rubytech/create-maxy-code for other recorded verdicts.

Review the evidence and your use of @rubytech/create-maxy-code@0.1.521 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-28 18:30:52.806Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @rubytech

Behavioral surface

Related packages

More from @rubytech

Source & flagged code