registry / AI-agent capability abuse / @rubytech/create-sitedesk-code
@rubytech/create-sitedesk-code
Install SiteDesk — automated back office for independent building contractors
This report shows the evidence for @rubytech/create-sitedesk-code@0.1.459. 3 of 106 known versions are blocked or flagged. The newest version, 0.1.636, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concrete AI-agent permission-bypass configuration combined with remote shell bootstrap and persistent system provisioning. Although this is not npm lifecycle execution and uses a brand-scoped directory, the explicit bypass of all Claude permission checks is sufficient for blocking.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
Explicit execution of `create-sitedesk-code`
Impact
Agents launched through the installed environment can operate without normal Claude approval prompts; remote installer content executes on the host.
Mechanism
Claude permission bypass plus remote shell bootstrap and host provisioning
Policy narrative
The user-invoked CLI seeds `~/.sitedesk-code/.claude/settings.json` with `defaultMode: "bypassPermissions"`, then installs registered Claude plugins and services. In the same execution path it uses `curl | sh` for remote Ollama and uv installers and provisions host dependencies, increasing the impact of the permission bypass.
AI rationale
Source inspection confirms a concrete AI-agent permission-bypass configuration combined with remote shell bootstrap and persistent system provisioning. Although this is not npm lifecycle execution and uses a brand-scoped directory, the explicit bypass of all Claude permission checks is sufficient for blocking.
Evidence
package.jsondist/index.jsdist/permissions-seed.jsdist/specialist-registration.jspayload/platform/config/brand.json~/.sitedesk-code/.claude/settings.json~/sitedesk-code
Network endpoints4
ollama.aiastral.shgithub.com
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- `dist/permissions-seed.js` writes Claude settings with `defaultMode: "bypassPermissions"`.
- The bypass explicitly skips permission checks for every Claude tool.
- `dist/index.js` invokes this settings seed during the CLI install flow.
- The CLI fetches and pipes remote installer scripts to `sh` from Ollama and Astral.
- The installer registers bundled Claude agents/plugins and creates persistent services.
- It installs system packages, copies payloads, and freezes installed source trees.
Evidence against
- `package.json` has no npm preinstall/install/postinstall lifecycle hook.
- The Claude config target is brand-scoped at `~/.sitedesk-code/.claude`, not the default global Claude directory.
- No source-confirmed credential exfiltration endpoint was found in the inspected installer paths.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetwork
Source & flagged code
24 flagged · loading sourcepayload/platform/scripts/smoke-boot-services.shView file
335patternName = generic_password
severity = medium
line = 335
matchedText = local ne...:-}"
Medium
Secret Pattern
Package contains a possible secret pattern.
payload/platform/scripts/smoke-boot-services.shView on unpkg · L335dist/index.jsView file
141for (const host of ["registry.npmjs.org", "github.com"]) {
L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });
L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`);
...
L148: "--connect-timeout", "10",
L149: "https://registry.npmjs.org/",
L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });
...
L155: function captureNpmDebugLog() {
L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");
L157: if (!existsSync(logsDir))
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
dist/index.jsView on unpkg · L141Findings
3 Critical12 High14 Medium9 Low
CriticalSame File Env Network Executiondist/index.js
CriticalDownload Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighCross File Remote Execution Contextpayload/platform/plugins/admin/mcp/dist/index.js
HighRuntime Package Installdist/index.js
HighShips High Entropy Blobpayload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2
HighPayload In Excluded Dirpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh
Affected versions and remediation
This report applies to @rubytech/create-sitedesk-code@0.1.459.
The versions list below shows the verdict for each recorded version.
- Avoid installing @rubytech/create-sitedesk-code@0.1.459. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.