@rubytech/create-sitedesk-code@0.1.464: Suspicious npm security

Loading npm security reports…

@rubytech/create-sitedesk-code@0.1.464: Suspicious npm security | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/index.js` is a user-invoked installer CLI that deploys services and plugins.
`dist/permissions-seed.js` rewrites brand-scoped Claude settings with `defaultMode: "bypassPermissions"`.
`dist/index.js` primes a trusted Claude workspace and registers user-scope Claude plugins.
`dist/index.js` executes `curl -LsSf https://astral.sh/uv/install.sh | sh` during CLI installation.
`dist/index.js` conditionally adds Google's apt repository using a privileged curl|gpg pipeline.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
Claude configuration is directed to the package's per-brand `~/.sitedesk-code/.claude` directory, not the default `~/.claude`.
`dist/specialist-registration.js` only symlinks package-bundled agent files and rejects regular-file collisions.
No credential-harvesting or secret-exfiltration chain was identified in the reviewed installer and agent-setup paths.
The flagged font blob is a normal bundled `.woff2` asset, not executable source.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 821 file(s), 12.6 MB of source, external domains: 0.0.0.0, 127.0.0.1, api.anthropic.com, api.cloudflare.com, api.replicate.com, api.telegram.org, appcenter.intuit.com, astral.sh, brew.sh, chevrotain.io, claude.ai, deb.nodesource.com, debian.neo4j.com, dl.google.com, docs.getmaxy.com, docs.realagent.network, en.wikipedia.org, fonts.googleapis.com, fonts.gstatic.com, getmaxy.com, github.com, graph.microsoft.com, langium.org, llmstxt.org, login.microsoftonline.com, maxy.bot, maxy.setup, ns.adobe.com, oauth.platform.intuit.com, ollama.ai, one.dash.cloudflare.com, platform.claude.com, player.vimeo.com, quickbooks.api.intuit.com, react.dev, registry.npmjs.org, sandbox-quickbooks.api.intuit.com, schema.org, www.anthropic.com, www.linkedin.com, www.w3.org, www.xfa.org, www.youtube-nocookie.com

Source & flagged code

24 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

Lines 8-48javascript

8 * 2. Every compiled tool module loads without throwing.

9 * 3. Every exported handler is a function

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View file

•path = [redacted]-latin-ext-500-normal-AH9qog1s.woff2 kind = high_entropy_blob sizeBytes = 19620 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-read-attachment.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-availability.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/brew-install.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Source & flagged code

24 flagged · loading source

payload/platform/scripts/smoke-boot-services.shView file

335patternName = generic_password severity = medium line = 335 matchedText = local ne...:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

dist/index.jsView file

141for (const host of ["registry.npmjs.org", "github.com"]) { L142: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 }); L143: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`); ... L148: "--connect-timeout", "10", L149: "https://registry.npmjs.org/", L150: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 }); ... L155: function captureNpmDebugLog() { L156: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs"); L157: if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L141

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L51: } L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.configDir); ... L107: ` ${BRAND.productName} Install Log — ${new Date().toISOString()}`, L108: ` Node ${process.version} | ${process.platform} ${process.arch}`, L109: "=".repeat(64),

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L51: } L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.configDir); ... L107: ` ${BRAND.productName} Install Log — ${new Date().toISOString()}`, L108: ` Node ${process.version} | ${process.platform} ${process.arch}`, L109: "=".repeat(64),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

536// Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe L537: // composition runs through bash -c so the curl|gpg pipeline is one L538: // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L536

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

284function canSudo() { L285: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 }); L286: return result.status === 0; ... L288: /** True when the npm global prefix's node_modules dir is writable by the current L289: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */ L290: function npm[redacted]() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L284

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/index.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

28Cross-file remote execution chain: payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L28: * L29: * Exit code: 0 on pass, 1 on any assertion failure. L30: */ ... L35: import { readdirSync } from "node:fs"; L36: import { spawn } from "node:child_process"; L37: L38: const __dirname = dirname(fileURLToPath(import.meta.url)); L39: const TOOLS_SRC = join(__dirname, "../src/tools"); ... L234: const { closeDriver } = await import("../dist/lib/neo4j.js"); L235: const savedUri = process.env.NEO4J_URI; L236: try { ... L786: // lowercased once here so the Cypher compares term-to-body directly, and

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView on unpkg · L28

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View file

•path = [redacted]-latin-ext-500-normal-AH9qog1s.woff2 kind = high_entropy_blob sizeBytes = 19620 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Findings

3 Critical12 High14 Medium9 Low

CriticalSame File Env Network Executiondist/index.js

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextpayload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjs

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobpayload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2

HighPayload In Excluded Dirpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh

HighKnown Malware Source Similaritydist/index.js

HighKnown Malware Source Similaritypayload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js

HighKnown Malware Source Similaritypayload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js

HighKnown Malware Source Similaritypayload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.js

HighKnown Malware Source Similaritydist/brew-install.js

MediumSecret Patternpayload/platform/scripts/smoke-boot-services.sh

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumProtestware

MediumShips Build Helperpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternpayload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

MediumSecret Patternpayload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

MediumSecret Patternpayload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

24 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

Lines 8-48javascript

8 * 2. Every compiled tool module loads without throwing.

9 * 3. Every exported handler is a function

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View file

•path = [redacted]-latin-ext-500-normal-AH9qog1s.woff2 kind = high_entropy_blob sizeBytes = 19620 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Lines 121-161javascript

121const _log = console.log;

122const _err = console.error;

123console.log = (...args) => { _log(...args); logFile(args.map(String).join(" ")); };

124console.error = (...args) => { _err(...args); logFile(`[ERROR] ${args.map(String).join(" ")}`); };

125// ---------------------------------------------------------------------------

126// Diagnostics — system state snapshot for post-mortem analysis

127// ---------------------------------------------------------------------------

128function logDiagnostics(label) {

129 logFile(`\n--- Diagnostics: ${label} ---`);

130 if (!isLinux()) {

131 logFile(" (not Linux — limited diagnostics)");

132 return;

133 }

134 const run = (cmd, args) => {

135 const r = spawnSync(cmd, args, { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });

136 return (r.stdout || r.stderr || "").trim();

137 };

138 logFile(`Disk:\n${run("df", ["-h", "/", "/tmp"])}`);

139 logFile(`Memory:\n${run("free", ["-h"])}`);

140 logFile(`Uptime: ${run("uptime", [])}`);

141 for (const host of ["registry.npmjs.org", "github.com"]) {

142 const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });

143 logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").

144 }

145 const curl = spawnSync("curl", [

146 "-sf", "-o", "/dev/null",

147 "-w", "HTTP %{http_code} in %{time_total}s (dns: %{time_namelookup}s, connect: %{time_connect}s)",

148 "--connect-timeout", "10",

149 "https://registry.npmjs.org/",

150 ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });

151 logFile(`Registry HTTP: ${curl.stdout?.trim() || `FAIL — ${curl.stderr?.trim()}`}`);

152 logFile(`--- End Diagnostics ---\n`);

153}

154/** Append the most recent npm debug log into our install log for post-mortem. */

155function captureNpmDebugLog() {

156 const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");

157 if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L141

158 return;

159 try {

160 const files = readdirSync(logsDir).filter(f => f.endsWith("-debug-0.log")).sort().reverse();

161 if (files[0]) {

Lines 516-556javascript

516 catch {

517 return null;

518 }

519 };

520 const whichChromium = which("chromium");

521 const whichGoogleChrome = which("google-chrome-stable");

522 const decision = decideChromiumAction({

523 platform: "linux",

524 whichChromium,

525 realpathChromium: realpath(whichChromium),

526 whichGoogleChrome,

527 realpathGoogleChrome: realpath(whichGoogleChrome),

528 });

529 logFile(` [snap-chromium] decision: ${decision.action} reason="${decision.reason}"`);

530 if (decision.action === "fail") {

531 throw new Error(`ensureNonSnapChromium: ${decision.reason}. apt install of \`chromium\` ran in installAptGroup(VNC stack) above; if its post-check passed but no chromium binary is on PATH, the system PATH is misconfigured.`);

532 }

533 if (decision.action === "install-google-chrome") {

534 console.log(" Detected snap-confined Chromium — installing Google Chrome stable...");

535 logFile(` [snap-chromium] installing google-chrome-stable from Google's signed apt repo`);

536 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe

537 // composition runs through bash -c so the curl|gpg pipeline is one

538 // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L536

539 console.log(" [privileged] curl + gpg --dearmor (Google Chrome signing key)");

540 shell("bash", ["-c",

541 "set -euo pipefail; " +

542 "curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | " +

543 "gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/google-chrome.gpg",

544 ], { sudo: true });

545 // Add the apt source list with `signed-by=` scoping so the key only

546 // verifies google-chrome-* packages, not arbitrary repo overrides. arch

547 // pinned to amd64 — Google does not ship arm64 Chrome for Linux.

548 console.log(" [privileged] tee /etc/apt/sources.list.d/google-chrome.list");

549 shell("bash", ["-c",

550 "echo 'deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/google-chrome.gpg] " +

551 "http://dl.google.com/linux/chrome/deb/ stable main' " +

552 "> /etc/apt/sources.list.d/google-chrome.list",

553 ], { sudo: true });

554 console.log(" [privileged] apt-get update");

555 shell("apt-get", ["update"], { sudo: true });

556 installAptGroup("Google Chrome stable", ["google-chrome-stable"]);

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code