@rubytech/create-sitedesk-code@0.1.472: Suspicious npm security

Loading npm security reports…

@rubytech/create-sitedesk-code@0.1.472: Suspicious npm security | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` runs an installer when the user invokes its bin.
`dist/permissions-seed.js` writes `permissions.defaultMode: "bypassPermissions"` into the brand Claude settings.
`dist/index.js` seeds that settings file and registers bundled agents under the package-owned `CLAUDE_CONFIG_DIR`.
`dist/index.js` marks the configured home workspace as trusted in the brand `.claude.json`.
`dist/index.js` installs local Claude marketplaces/plugins and executes privileged system setup commands.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
The sensitive behavior is reachable through the explicit `create-sitedesk-code` CLI, not package import/install.
Observed downloads are named installer dependencies, including pinned Cloudflared and whisper.cpp sources.
No source evidence found of credential harvesting or exfiltration to an attacker-controlled endpoint.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 863 file(s), 12.8 MB of source, external domains: 0.0.0.0, 127.0.0.1, accounts.google.com, api.anthropic.com, api.cloudflare.com, api.replicate.com, api.telegram.org, appcenter.intuit.com, astral.sh, brew.sh, chevrotain.io, claude.ai, deb.nodesource.com, debian.neo4j.com, dl.google.com, docs.getmaxy.com, docs.realagent.network, en.wikipedia.org, fonts.googleapis.com, fonts.gstatic.com, getmaxy.com, github.com, graph.microsoft.com, langium.org, llmstxt.org, login.microsoftonline.com, maxy.bot, maxy.setup, ns.adobe.com, oauth.platform.intuit.com, oauth2.googleapis.com, ollama.ai, one.dash.cloudflare.com, platform.claude.com, player.vimeo.com, quickbooks.api.intuit.com, react.dev, registry.npmjs.org, sandbox-quickbooks.api.intuit.com, schema.org, www.anthropic.com, www.googleapis.com, www.linkedin.com, www.w3.org, www.xfa.org, www.youtube-nocookie.com

Source & flagged code

24 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

3import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

Lines 8-48javascript

8 * 2. Every compiled tool module loads without throwing.

9 * 3. Every exported handler is a function

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View file

•path = [redacted]-latin-ext-500-normal-AH9qog1s.woff2 kind = high_entropy_blob sizeBytes = 19620 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-read-attachment.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-availability.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = dist/brew-install.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/lib/claude-bridge.jsView file

•matchType = normalized_sha256 matchedPackage = @rubytech/create-sitedesk-code@0.1.459 matchedPath = [redacted]-bridge.js matchedIdentity = npm:[redacted]:0.1.459 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/email/mcp/dist/lib/claude-bridge.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Source & flagged code

24 flagged · loading source

payload/platform/scripts/smoke-boot-services.shView file

335patternName = generic_password severity = medium line = 335 matchedText = local ne...:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

dist/index.jsView file

161for (const host of ["registry.npmjs.org", "github.com"]) { L162: const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 }); L163: logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").trim().split("\n")[0]}`); ... L168: "--connect-timeout", "10", L169: "https://registry.npmjs.org/", L170: ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 }); ... L175: function captureNpmDebugLog() { L176: const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs"); L177: if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L161

1#!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L51: } L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L53: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/index.js L1: #!/usr/bin/env node L2: import { execFileSync, spawn, spawnSync } from "node:child_process"; L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta... ... L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js"; L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js"; L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js"; ... L51: } L52: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir); L53: const PERS

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

556// Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe L557: // composition runs through bash -c so the curl|gpg pipeline is one L558: // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L556

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

304function canSudo() { L305: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 }); L306: return result.status === 0; ... L308: /** True when the npm global prefix's node_modules dir is writable by the current L309: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */ L310: function npm[redacted]() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L304

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

28Cross-file remote execution chain: payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L28: * L29: * Exit code: 0 on pass, 1 on any assertion failure. L30: */ ... L35: import { readdirSync } from "node:fs"; L36: import { spawn } from "node:child_process"; L37: L38: const __dirname = dirname(fileURLToPath(import.meta.url)); L39: const TOOLS_SRC = join(__dirname, "../src/tools"); ... L234: const { closeDriver } = await import("../dist/lib/neo4j.js"); L235: const savedUri = process.env.NEO4J_URI; L236: try { ... L786: // lowercased once here so the Cypher compares term-to-body directly, and

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView on unpkg · L28

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View file

•path = [redacted]-latin-ext-500-normal-AH9qog1s.woff2 kind = high_entropy_blob sizeBytes = 19620 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/lib/claude-bridge.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/email/mcp/dist/lib/claude-bridge.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Findings

3 Critical12 High14 Medium9 Low

CriticalSame File Env Network Executiondist/index.js

CriticalDownload Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/index.js

HighShelldist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

HighCross File Remote Execution Contextpayload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjs

HighRuntime Package Installdist/index.js

HighShips High Entropy Blobpayload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2

HighPayload In Excluded Dirpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh

HighKnown Malware Source Similaritypayload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.js

HighKnown Malware Source Similaritypayload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.js

HighKnown Malware Source Similaritypayload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.js

HighKnown Malware Source Similaritydist/brew-install.js

HighKnown Malware Source Similaritypayload/platform/plugins/email/mcp/dist/lib/claude-bridge.js

MediumSecret Patternpayload/platform/scripts/smoke-boot-services.sh

MediumDynamic Require

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumProtestware

MediumShips Build Helperpayload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternpayload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

MediumSecret Patternpayload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

MediumSecret Patternpayload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

LowNon Install Lifecycle Scripts

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

24 flagged

payload/platform/scripts/smoke-boot-services.shView file

Lines 315-355shell

315 local required="${SMOKE_CYPHER_SCHEMA:-optional}"

316

317 skip_msg() { # $1=reason

318 if [ "$required" = "required" ]; then

319 echo "[smoke-boot] cypher-schema=fail err=$1 (SMOKE_CYPHER_SCHEMA=required)" >&2

320 return 1

321 fi

322 echo "[smoke-boot] cypher-schema=skip reason=$1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"

323 return 0

324 }

325

326 if ! command -v cypher-shell >/dev/null 2>&1; then

327 skip_msg cypher-shell-not-on-path; return $?

328 fi

329

330 if [ -z "${NEO4J_URI:-}" ]; then

331 skip_msg neo4j-uri-unset; return $?

332 fi

333

334 local neo4j_user="${NEO4J_USER:-neo4j}"

335 local neo4j_password="${NEO4J_PASSWORD:-}"

Medium

Secret Pattern

Package contains a possible secret pattern.

payload/platform/scripts/smoke-boot-services.shView on unpkg · L335

336 if [ -z "$neo4j_password" ]; then

337 # Fall back to the same password-file convention seed-neo4j.sh uses.

338 local pw_file="$REPO_ROOT/platform/config/.neo4j-password"

339 if [ -f "$pw_file" ]; then

340 neo4j_password="$(cat "$pw_file")"

341 fi

342 fi

343 if [ -z "$neo4j_password" ]; then

344 skip_msg neo4j-password-unset; return $?

345 fi

346

347 # Live probe: if the credentials don't authenticate, the check would fail

348 # for reasons unrelated to schema syntax (rotated password, etc.). Skip

349 # rather than fail so the maintainer's own install's Neo4j — whose password

350 # they own — can't block publish.

351 if ! cypher-shell -u "$neo4j_user" -p "$neo4j_password" -a "$NEO4J_URI" \

352 --non-interactive "RETURN 1" >/dev/null 2>&1; then

353 skip_msg neo4j-auth-failed; return $?

354 fi

355

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync, spawn, spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4import

payload/platform/plugins/voice-mirror/mcp/scripts/smoke.mjsView file

Lines 8-48javascript

8 * 2. Every compiled tool module loads without throwing.

9 * 3. Every exported handler is a function

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView file

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = payload_in_excluded_dir sizeBytes = 936 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

•path = payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.sh kind = build_helper sizeBytes = 936 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

payload/platform/plugins/prompt-optimiser/skills/prompt-optimiser/__tests__/restatement-ladder.test.shView on unpkg

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View file

•path = [redacted]-latin-ext-500-normal-AH9qog1s.woff2 kind = high_entropy_blob sizeBytes = 19620 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

payload/server/public/assets/cormorant-latin-ext-500-normal-AH9qog1s.woff2View on unpkg

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/cloudflare/mcp/dist/lib/cloudflared.jsView on unpkg

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/memory/mcp/dist/tools/memory-read-attachment.jsView on unpkg

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/scheduling/mcp/dist/scripts/publish-availability.jsView on unpkg

dist/brew-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/brew-install.jsView on unpkg

payload/platform/plugins/email/mcp/dist/lib/claude-bridge.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

payload/platform/plugins/email/mcp/dist/lib/claude-bridge.jsView on unpkg

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView file

52patternName = generic_password severity = medium line = 52 matchedText = credenti..." },

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-delete.test.jsView on unpkg · L52

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView file

28patternName = generic_password severity = medium line = 28 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L28

43patternName = generic_password severity = medium line = 43 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L43

57patternName = generic_password severity = medium line = 57 matchedText = password...nt",

Medium

Secret Pattern

Hardcoded password in payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.js

payload/platform/plugins/email/mcp/dist/__tests__/email-setup.test.jsView on unpkg · L57

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView file

73patternName = generic_password severity = medium line = 73 matchedText = { passwo...' },

Medium

Secret Pattern

Hardcoded password in payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.ts

payload/platform/lib/task-secrets/src/__tests__/redact-secrets.test.tsView on unpkg · L73

Lines 141-181javascript

141const _log = console.log;

142const _err = console.error;

143console.log = (...args) => { _log(...args); logFile(args.map(String).join(" ")); };

144console.error = (...args) => { _err(...args); logFile(`[ERROR] ${args.map(String).join(" ")}`); };

145// ---------------------------------------------------------------------------

146// Diagnostics — system state snapshot for post-mortem analysis

147// ---------------------------------------------------------------------------

148function logDiagnostics(label) {

149 logFile(`\n--- Diagnostics: ${label} ---`);

150 if (!isLinux()) {

151 logFile(" (not Linux — limited diagnostics)");

152 return;

153 }

154 const run = (cmd, args) => {

155 const r = spawnSync(cmd, args, { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });

156 return (r.stdout || r.stderr || "").trim();

157 };

158 logFile(`Disk:\n${run("df", ["-h", "/", "/tmp"])}`);

159 logFile(`Memory:\n${run("free", ["-h"])}`);

160 logFile(`Uptime: ${run("uptime", [])}`);

161 for (const host of ["registry.npmjs.org", "github.com"]) {

162 const dns = spawnSync("host", ["-W", "5", host], { encoding: "utf-8", stdio: "pipe", timeout: 10_000 });

163 logFile(`DNS ${host}: ${dns.status === 0 ? "OK" : "FAIL"} — ${(dns.stdout || dns.stderr || "").

164 }

165 const curl = spawnSync("curl", [

166 "-sf", "-o", "/dev/null",

167 "-w", "HTTP %{http_code} in %{time_total}s (dns: %{time_namelookup}s, connect: %{time_connect}s)",

168 "--connect-timeout", "10",

169 "https://registry.npmjs.org/",

170 ], { encoding: "utf-8", stdio: "pipe", timeout: 15_000 });

171 logFile(`Registry HTTP: ${curl.stdout?.trim() || `FAIL — ${curl.stderr?.trim()}`}`);

172 logFile(`--- End Diagnostics ---\n`);

173}

174/** Append the most recent npm debug log into our install log for post-mortem. */

175function captureNpmDebugLog() {

176 const logsDir = resolve(process.env.HOME ?? "/root", ".npm/_logs");

177 if (!existsSync(logsDir))

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L161

178 return;

179 try {

180 const files = readdirSync(logsDir).filter(f => f.endsWith("-debug-0.log")).sort().reverse();

181 if (files[0]) {

Lines 536-576javascript

536 catch {

537 return null;

538 }

539 };

540 const whichChromium = which("chromium");

541 const whichGoogleChrome = which("google-chrome-stable");

542 const decision = decideChromiumAction({

543 platform: "linux",

544 whichChromium,

545 realpathChromium: realpath(whichChromium),

546 whichGoogleChrome,

547 realpathGoogleChrome: realpath(whichGoogleChrome),

548 });

549 logFile(` [snap-chromium] decision: ${decision.action} reason="${decision.reason}"`);

550 if (decision.action === "fail") {

551 throw new Error(`ensureNonSnapChromium: ${decision.reason}. apt install of \`chromium\` ran in installAptGroup(VNC stack) above; if its post-check passed but no chromium binary is on PATH, the system PATH is misconfigured.`);

552 }

553 if (decision.action === "install-google-chrome") {

554 console.log(" Detected snap-confined Chromium — installing Google Chrome stable...");

555 logFile(` [snap-chromium] installing google-chrome-stable from Google's signed apt repo`);

556 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe

557 // composition runs through bash -c so the curl|gpg pipeline is one

558 // privileged command rather than two separate sudo escalations.

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L556

559 console.log(" [privileged] curl + gpg --dearmor (Google Chrome signing key)");

560 shell("bash", ["-c",

561 "set -euo pipefail; " +

562 "curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | " +

563 "gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/google-chrome.gpg",

564 ], { sudo: true });

565 // Add the apt source list with `signed-by=` scoping so the key only

566 // verifies google-chrome-* packages, not arbitrary repo overrides. arch

567 // pinned to amd64 — Google does not ship arm64 Chrome for Linux.

568 console.log(" [privileged] tee /etc/apt/sources.list.d/google-chrome.list");

569 shell("bash", ["-c",

570 "echo 'deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/google-chrome.gpg] " +

571 "http://dl.google.com/linux/chrome/deb/ stable main' " +

572 "> /etc/apt/sources.list.d/google-chrome.list",

573 ], { sudo: true });

574 console.log(" [privileged] apt-get update");

575 shell("apt-get", ["update"], { sudo: true });

576 installAptGroup("Google Chrome stable", ["google-chrome-stable"]);

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code