registry / @rubytech/create-maxy-code / 0.1.581
@rubytech/create-maxy-code@0.1.581
Install Maxy — AI for Productive People
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not concretely malicious by the stated boundary, but its explicit installer creates a first-party agent environment with bypassed permissions and remote bootstrap execution. This warrants a warning for agent-extension lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
User runs the create-maxy-code CLI.
Impact
The invoked installer can modify system services and leave the brand's Claude sessions with permission checks bypassed.
Mechanism
first-party AI-agent environment provisioning with remote dependency bootstrap
AI rationale
The package is not concretely malicious by the stated boundary, but its explicit installer creates a first-party agent environment with bypassed permissions and remote bootstrap execution. This warrants a warning for agent-extension lifecycle risk.
Evidence
package.jsondist/index.jsdist/permissions-seed.jspayload/platform/config/brand.json~/.maxy-code/.claude/settings.json~/.maxy-code/.claude/plugins/installed_plugins.json
Network endpoints4
deb.nodesource.com/setup_22.xollama.ai/install.shastral.sh/uv/install.shregistry.npmjs.org/
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/index.js executes a full privileged installer when its bin is explicitly run.
- dist/permissions-seed.js writes bypassPermissions into ~/.maxy-code/.claude/settings.json.
- dist/index.js installs Claude marketplaces/plugins under the brand-scoped CLAUDE_CONFIG_DIR.
- dist/index.js downloads and executes upstream NodeSource, Ollama, and uv installers.
Evidence against
- package.json has no preinstall, install, or postinstall hook; prepublishOnly is publish-time only.
- Agent configuration is scoped to the package's ~/.maxy-code/.claude directory, not the user's default ~/.claude.
- Observed network downloads are named upstream dependency/install endpoints; no credential harvesting or exfiltration path was found.
- No unconsented install-time mutation occurs on npm install; behavior requires running create-maxy-code.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
NoLicense
Source & flagged code
18 flagged · loading sourcepayload/platform/scripts/smoke-boot-services.shView file
349patternName = generic_password
severity = medium
line = 349
matchedText = local ne...:-}"
Medium
Secret Pattern
Package contains a possible secret pattern.
payload/platform/scripts/smoke-boot-services.shView on unpkg · L349dist/index.jsView file
141for (const host of ["registry.npmjs.org", "github.com"]) {
L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`);
...
L148: "--connect-timeout", "10",
L149: "https://registry.npmjs.org/",
L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });
...
L155: function captureNpmDebugLog() {
L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");
L157: if (!existsSync(logsDir))
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L1411#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Critical
Download Execute
Source downloads or fetches remote code and executes it.
dist/index.jsView on unpkg · L11Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERS
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.jsView on unpkg · L11#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
High
536// Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
L537: // composition runs through bash -c so the curl|gpg pipeline is one
L538: // privileged command rather than two separate sudo escalations.
High
1#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.jsView on unpkg · L11Trigger-reachable persistence chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.jsView on unpkg · L1284function canSudo() {
L285: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
L286: return result.status === 0;
...
L288: /** True when the npm global prefix's node_modules dir is writable by the current
L289: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
L290: function npm[redacted]() {
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L2841#!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L51: }
L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.jsView on unpkg · L1payload/platform/plugins/memory/mcp/scripts/graph/accept.shView file
20Cross-file remote execution chain: [redacted].sh spawns dist/index.js; helper contains network access plus dynamic code execution.
L20: #
L21: # Exit codes:
L22: # 0 all PASS
...
L36: if ! command -v uvx >/dev/null 2>&1; then
L37: echo "FAIL: uvx not on PATH — run: curl -LsSf https://astral.sh/uv/install.sh | sh -s -- -y" >&2
L38: exit 2
...
L64: node -e "
L65: const { spawn } = require('node:child_process');
L66: const proc = spawn('node', [process.env.SHIM], { stdio: ['pipe', 'pipe', 'inherit'] });
L67: let buf = '';
L68: proc.stdout.on('data', (chunk) => { buf += chunk.toString('utf8'); });
L69: const send = (obj) => proc.stdin.write(JSON.stringify(obj) + '\n');
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
payload/platform/plugins/memory/mcp/scripts/graph/accept.shView on unpkg · L20payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file
•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
kind = payload_in_excluded_dir
sizeBytes = 1019
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
kind = build_helper
sizeBytes = 1019
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkgpayload/server/public/assets/copy-nkxspu2J.js.gzView file
•path = [redacted]-nkxspu2J.js.gz
kind = compressed_blob
sizeBytes = 210
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
payload/server/public/assets/copy-nkxspu2J.js.gzView on unpkgpayload/server/public/assets/src-BvINb2fL.js.gzView file
•path = [redacted]-BvINb2fL.js.gz
kind = high_entropy_blob
sizeBytes = 15903
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
payload/server/public/assets/src-BvINb2fL.js.gzView on unpkgpayload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file
•matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = [redacted].js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkgpayload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file
•matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = [redacted]-read-attachment.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkgdist/brew-install.jsView file
•matchType = normalized_sha256
matchedPackage = @rubytech/create-sitedesk-code@0.1.459
matchedPath = dist/brew-install.js
matchedIdentity = npm:[redacted]:0.1.459
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/brew-install.jsView on unpkgFindings
3 Critical11 High9 Medium9 Low
CriticalSame File Env Network Executiondist/index.js
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCross File Remote Execution Contextpayload/platform/plugins/memory/mcp/scripts/graph/accept.sh
HighTrigger Reachable Persistencedist/index.js
HighRuntime Package Installdist/index.js
HighShips High Entropy Blobpayload/server/public/assets/src-BvINb2fL.js.gz
HighPayload In Excluded Dirpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
HighKnown Malware Source Similaritypayload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js
HighKnown Malware Source Similaritypayload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js
HighKnown Malware Source Similaritydist/brew-install.js
MediumSecret Patternpayload/platform/scripts/smoke-boot-services.sh
MediumDynamic Require
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumProtestware
MediumShips Build Helperpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
MediumShips Compressed Blobpayload/server/public/assets/copy-nkxspu2J.js.gz
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @rubytech/create-maxy-code@0.1.581.
See all versions of @rubytech/create-maxy-code for other recorded verdicts.
- Review the evidence and your use of @rubytech/create-maxy-code@0.1.581 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.