Loading npm security reports…
@rubytech/create-sitedesk-code@0.1.632: AI-agent capability abuse | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
@rubytech/create-sitedesk-code@0.1.632 Install SiteDesk — automated back office for independent building contractors
scanned 1mo ago · by lpm-firewall-ai This is a dangerous explicit-user installer with broad agent-control and persistence capabilities, so it warrants a warning. It lacks an automatic install lifecycle hook and the inspected Telegram code is feature-oriented rather than demonstrated credential theft.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An operator runs the create-sitedesk-code CLI and later uses the configured runtime features.
Impact
A user who runs the installer grants its bundled agent broad tool authority and enables persistent local services; configured documents may be sent to Telegram.
Mechanism
Claude permission bypass and plugin installation with Telegram document delivery.
AI rationale
This is a dangerous explicit-user installer with broad agent-control and persistence capabilities, so it warrants a warning. It lacks an automatic install lifecycle hook and the inspected Telegram code is feature-oriented rather than demonstrated credential theft.
Evidence
dist/index.js dist/permissions-seed.js payload/server/server.js
public snapshot AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
The user-invoked installer seeds Claude settings with bypassed permission checks. It installs bundled and configured Claude plugins at user scope. Its runtime can upload a local document to the Telegram Bot API. Evidence against
The manifest has no preinstall, install, or postinstall hook; its executable is a bin command. The observed network upload is a Telegram channel feature using a supplied bot token, not evidence of automatic credential harvesting. No source evidence established stealthy exfiltration or execution during npm installation. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
Supply chain HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings
31 flagged · loading source payload/platform/scripts/smoke-boot-services.sh View file 349 patternName = generic_password
severity = medium
line = 349
Medium Secret Pattern
Package contains a possible secret pattern.
payload/platform/scripts/smoke-boot-services.sh View on unpkg · L349 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Critical Download Execute
Source downloads or fetches remote code and executes it.
dist/index.js 3 Critical 22 High 8 Medium 9 Low
Critical Credential Exfiltration payload/server/server.js
Critical Download Execute dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
High Child Process dist/index.js
High Shell dist/index.js
High Same File Env Network Execution payload/server/server.js
High Command Output Exfiltration payload/server/server.js
High Sandbox Evasion Gated Capability dist/index.js
High Cross File Remote Execution Context payload/platform/plugins/admin/mcp/dist/index.js
High Trigger Reachable Persistence dist/index.js
High Runtime Package Install dist/index.js
Affected versions and remediation This report applies to @rubytech/create-sitedesk-code@0.1.632 .
See all versions of @rubytech/create-sitedesk-code for other recorded verdicts.
Review the evidence and your use of @rubytech/create-sitedesk-code@0.1.632 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-16 02:35:33.714Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
scanned 1,092 file(s), 16.8 MB of source, external domains: 0.0.0.0, 127.0.0.1, account.microsoft.com, accounts.google.com, acme.example.com, api.cloudflare.com, api.replicate.com, api.telegram.org, appcenter.intuit.com, astral.sh, brew.sh, chevrotain.io, claude.ai, core.telegram.org, deb.nodesource.com, debian.neo4j.com, dl.google.com, docs.getmaxy.com, docs.realagent.network, en.wikipedia.org, fonts.googleapis.com, fonts.gstatic.com, getmaxy.com, github.com, graph.microsoft.com, langium.org, llmstxt.org, login.microsoftonline.com, maxy.bot, maxy.institute, ns.adobe.com, oauth.platform.intuit.com, oauth2.googleapis.com, ollama.ai, one.dash.cloudflare.com, platform.claude.com, player.vimeo.com, quickbooks.api.intuit.com, raw.githubusercontent.com, react.dev, registry.npmjs.org, sandbox-quickbooks.api.intuit.com, schema.org, tile.openstreetmap.org, www.anthropic.com, www.apple.com, www.googleapis.com, www.linkedin.com, www.openstreetmap.org, www.w3.org
1 Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERS
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg · L1 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 537 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
L538: // composition runs through bash -c so the curl|gpg pipeline is one
L539: // privileged command rather than two separate sudo escalations.
1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.js View on unpkg · L1 1 Trigger-reachable persistence chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.js View on unpkg · L1 285 function canSudo() {
L286: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
L287: return result.status === 0;
...
L289: /** True when the npm global prefix's node_modules dir is writable by the current
L290: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
L291: function npm[redacted]() {
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.js View on unpkg · L285 • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = dist/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.js View on unpkg · L1 payload/platform/plugins/ledger/lib/mcp-spawn-tee/index.js View file 8 * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
L9: * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
L10: * two. Before importing, it replaces process.stderr.write with a tee so every
Medium Dynamic Require
Package source references dynamic require/import behavior.
payload/platform/plugins/ledger/lib/mcp-spawn-tee/index.js View on unpkg · L8 payload/platform/plugins/admin/skills/flow-page/build.mjs View file 99 const LOG_FILE =
L100: process.env.LOG_DIR && existsSync(process.env.LOG_DIR)
L101: ? join(process.env.LOG_DIR, "flow-page.log")
...
L178: let model;
L179: try { model = JSON.parse(readFileSync(contentPath, "utf8")); }
L180: catch (e) { die(`[flow-page] op=bad-content slug=${slug} file=${contentPath} error=${e.message}`); }
...
L209: FONT_DISPLAY: fonts.display,
L210: FONT_BODY: fonts.body,
L211: ACCENT: palette.accent,
Low Weak Crypto
Package source references weak cryptographic algorithms.
payload/platform/plugins/admin/skills/flow-page/build.mjs View on unpkg · L99 358 try {
L359: out.push(JSON.parse(line));
L360: } catch {
...
L469: function telegramStoreRoot2(platformRoot5) {
L470: const brandDir = process.env.MAXY_DIR_OVERRIDE ?? (0, node_path_1.resolve)((0, node_os_1.homedir)(), configDirName2(platformRoot5));
L471: return (0, node_path_1.join)(brandDir, "data", "telegram-messages");
...
L566: var node_path_1 = __require("path");
L567: var TELEGRAM_API2 = "https://api.telegram.org";
L568: function refusalReason(body, status) {
...
L750: });
L751: process.stderr.write(`[trash:marked] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")} by=${by} reason=${reason ?? "null"}
L752: `);
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
payload/server/server.js View on unpkg · L358 5389 // app/lib/vnc.ts
L5390: import { spawnSync, execFileSync } from "child_process";
L5391: import { createConnection } from "net";
L5392: import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
L5393: import { resolve as resolve5 } from "path";
L5394: var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
L5395: var VNC_SCRIPT = resolve5(PLATFORM_ROOT2, "scripts/vnc.sh");
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
payload/server/server.js View on unpkg · L5389 358 try {
L359: out.push(JSON.parse(line));
L360: } catch {
...
L469: function telegramStoreRoot2(platformRoot5) {
L470: const brandDir = process.env.MAXY_DIR_OVERRIDE ?? (0, node_path_1.resolve)((0, node_os_1.homedir)(), configDirName2(platformRoot5));
L471: return (0, node_path_1.join)(brandDir, "data", "telegram-messages");
...
L566: var node_path_1 = __require("path");
L567: var TELEGRAM_API2 = "https://api.telegram.org";
L568: function refusalReason(body, status) {
...
L750: });
L751: process.stderr.write(`[trash:marked] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")} by=${by} reason=${reason ?? "null"}
L752: `);
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
payload/server/server.js View on unpkg · L358 payload/platform/plugins/admin/mcp/dist/index.js View file 6 Cross-file remote execution chain: [redacted].js spawns dist/index.js; helper contains network access plus dynamic code execution.
L6: import { resolve, join } from "node:path";
L7: import { execFile, execFileSync } from "node:child_process";
L8: import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
...
L19: import { createHash, randomInt, randomUUID } from "node:crypto";
L20: import { createConnection } from "node:net";
L21: import { homedir, hostname as osHostname } from "node:os";
...
L61: });
L62: const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname, "../../../..");
L63: // Plugin-system boot tolerance — see Task 202.
...
L67: const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
L
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
payload/platform/plugins/admin/mcp/dist/index.js View on unpkg · L6 payload/platform/plugins/memory/bin/conversation-archive-ingest.sh View file • path = [redacted]-archive-ingest.sh
kind = build_helper
sizeBytes = 4369
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
payload/platform/plugins/memory/bin/conversation-archive-ingest.sh View on unpkg payload/server/public/assets/graph-labels-BTFUSc63.js.gz View file • path = [redacted]-labels-BTFUSc63.js.gz
kind = high_entropy_blob
sizeBytes = 9968
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
payload/server/public/assets/graph-labels-BTFUSc63.js.gz View on unpkg • path = [redacted]-labels-BTFUSc63.js.gz
kind = compressed_blob
sizeBytes = 9968
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
payload/server/public/assets/graph-labels-BTFUSc63.js.gz View on unpkg payload/platform/lib/account-enumeration/dist/index.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 45
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
payload/platform/lib/account-enumeration/dist/index.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = dist/uninstall.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/uninstall.js View on unpkg payload/platform/lib/mcp-spawn-tee/dist/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/lib/mcp-spawn-tee/dist/index.js View on unpkg payload/platform/plugins/admin/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/admin/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/admin/skills/_lib/headless.mjs View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]_lib/headless.mjs
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/admin/skills/_lib/headless.mjs View on unpkg payload/platform/plugins/admin/skills/video-production/render.mjs View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-production/render.mjs
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/admin/skills/video-production/render.mjs View on unpkg payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/browser/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/browser/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/cloudflare/bin/portal-index-push.mjs View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-index-push.mjs
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/cloudflare/bin/portal-index-push.mjs View on unpkg payload/platform/plugins/connector/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/connector/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/contacts/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/contacts/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/dispatch/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/dispatch/lib/mcp-spawn-tee/index.js View on unpkg High
Ships High Entropy Blob
payload/server/public/assets/graph-labels-BTFUSc63.js.gz
High Semantic Analysis Limited payload/platform/lib/account-enumeration/dist/index.js#virtual:normalized:round1
High Known Malware Source Similarity dist/index.js
High Known Malware Source Similarity dist/uninstall.js
High Known Malware Source Similarity payload/platform/lib/mcp-spawn-tee/dist/index.js
High Known Malware Source Similarity payload/platform/plugins/admin/lib/mcp-spawn-tee/index.js
High Known Malware Source Similarity payload/platform/plugins/admin/skills/_lib/headless.mjs
High Known Malware Source Similarity payload/platform/plugins/admin/skills/video-production/render.mjs
High Known Malware Source Similarity payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js
High Known Malware Source Similarity payload/platform/plugins/browser/lib/mcp-spawn-tee/index.js
High Known Malware Source Similarity payload/platform/plugins/cloudflare/bin/portal-index-push.mjs
High Known Malware Source Similarity payload/platform/plugins/connector/lib/mcp-spawn-tee/index.js
High Known Malware Source Similarity payload/platform/plugins/contacts/lib/mcp-spawn-tee/index.js
High Known Malware Source Similarity payload/platform/plugins/dispatch/lib/mcp-spawn-tee/index.js
Medium Secret Pattern payload/platform/scripts/smoke-boot-services.sh
Medium Dynamic Require payload/platform/plugins/ledger/lib/mcp-spawn-tee/index.js
Medium Install Persistence dist/index.js
Medium Ships Build Helper payload/platform/plugins/memory/bin/conversation-archive-ingest.sh
Medium Ships Compressed Blob payload/server/public/assets/graph-labels-BTFUSc63.js.gz
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto payload/platform/plugins/admin/skills/flow-page/build.mjs
node >=22.6.0
Artifact 35.2 MB · 4,253 files 1 signature(s)
Install lifecycle prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings NoLicense
31 flagged payload/platform/scripts/smoke-boot-services.sh View file Lines 329-369 shell
329 local required = "${ SMOKE_CYPHER_SCHEMA :- optional }"
331 skip_msg () { # $1=reason
332 if [ " $required " = "required" ]; then
333 echo "[smoke-boot] cypher-schema=fail err= $1 (SMOKE_CYPHER_SCHEMA=required)" >&2
336 echo "[smoke-boot] cypher-schema=skip reason= $1 (export SMOKE_CYPHER_SCHEMA=required to fail hard; provision a disposable Neo4j to run the check)"
340 if ! command -v cypher-shell > /dev/null 2>&1 ; then
341 skip_msg cypher-shell-not-on-path ; return $?
344 if [ -z "${ NEO4J_URI :- }" ]; then
345 skip_msg neo4j-uri-unset ; return $?
348 local neo4j_user = "${ NEO4J_USER :- neo4j }"
349 local neo4j_password = "${ NEO4J_PASSWORD :- }"
Medium Secret Pattern
Package contains a possible secret pattern.
payload/platform/scripts/smoke-boot-services.sh View on unpkg · L349 350 if [ -z " $neo4j_password " ]; then
351 # Fall back to the same password-file convention seed-neo4j.sh uses.
352 local pw_file = " $REPO_ROOT /platform/config/.neo4j-password"
353 if [ -f " $pw_file " ]; then
354 neo4j_password = "$( cat " $pw_file ")"
357 if [ -z " $neo4j_password " ]; then
358 skip_msg neo4j-password-unset ; return $?
361 # Live probe: if the credentials don't authenticate, the check would fail
362 # for reasons unrelated to schema syntax (rotated password, etc.). Skip
363 # rather than fail so the maintainer's own install's Neo4j — whose password
364 # they own — can't block publish.
365 if ! cypher-shell -u " $neo4j_user " -p " $neo4j_password " -a " $NEO4J_URI " \
366 --non-interactive "RETURN 1" > /dev/null 2>&1 ; then
367 skip_msg neo4j-auth-failed ; return $?
1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Critical Download Execute
Source downloads or fetches remote code and executes it.
dist/index.js View on unpkg · L1 1 Trigger-reachable chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERS
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg · L1 payload/platform/plugins/ledger/lib/mcp-spawn-tee/index.js View file Lines 1-28 javascript
4 * MCP spawn-tee — in-process stderr capture + lifecycle observability.
6 * Claude Code spawns each MCP server itself; the platform never holds a
7 * ChildProcess handle. This shim sits between Claude Code and the real MCP
8 * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
9 * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
payload/platform/plugins/admin/skills/flow-page/build.mjs View file Lines 79-119 javascript
80 const argv = process.argv. slice ( 2 );
81 const arg = ( flag , fallback = null )
358 try {
L359: out.push(JSON.parse(line));
L360: } catch {
...
L469: function telegramStoreRoot2(platformRoot5) {
L470: const brandDir = process.env.MAXY_DIR_OVERRIDE ?? (0, node_path_1.resolve)((0, node_os_1.homedir)(), configDirName2(platformRoot5));
L471: return (0, node_path_1.join)(brandDir, "data", "telegram-messages");
...
L566: var node_path_1 = __require("path");
L567: var TELEGRAM_API2 = "https://api.telegram.org";
L568: function refusalReason(body, status) {
...
L750: });
L751: process.stderr.write(`[trash:marked] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")} by=${by} reason=${reason ?? "null"}
L752: `);
Critical Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
payload/server/server.js View on unpkg · L358 5389 // app/lib/vnc.ts
L5390: import { spawnSync, execFileSync } from "child_process";
L5391: import { createConnection } from "net";
L5392: import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
L5393: import { resolve as resolve5 } from "path";
L5394: var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
L5395: var VNC_SCRIPT = resolve5(PLATFORM_ROOT2, "scripts/vnc.sh");
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
payload/server/server.js View on unpkg · L5389 358 try {
L359: out.push(JSON.parse(line));
L360: } catch {
...
L469: function telegramStoreRoot2(platformRoot5) {
L470: const brandDir = process.env.MAXY_DIR_OVERRIDE ?? (0, node_path_1.resolve)((0, node_os_1.homedir)(), configDirName2(platformRoot5));
L471: return (0, node_path_1.join)(brandDir, "data", "telegram-messages");
...
L566: var node_path_1 = __require("path");
L567: var TELEGRAM_API2 = "https://api.telegram.org";
L568: function refusalReason(body, status) {
...
L750: });
L751: process.stderr.write(`[trash:marked] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")} by=${by} reason=${reason ?? "null"}
L752: `);
payload/platform/plugins/admin/mcp/dist/index.js View file 6 Cross-file remote execution chain: [redacted].js spawns dist/index.js; helper contains network access plus dynamic code execution.
L6: import { resolve, join } from "node:path";
L7: import { execFile, execFileSync } from "node:child_process";
L8: import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
...
L19: import { createHash, randomInt, randomUUID } from "node:crypto";
L20: import { createConnection } from "node:net";
L21: import { homedir, hostname as osHostname } from "node:os";
...
L61: });
L62: const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? resolve(import.meta.dirname, "../../../..");
L63: // Plugin-system boot tolerance — see Task 202.
...
L67: const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
L
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
payload/platform/plugins/admin/mcp/dist/index.js View on unpkg · L6 payload/platform/plugins/memory/bin/conversation-archive-ingest.sh View file • path = [redacted]-archive-ingest.sh
kind = build_helper
sizeBytes = 4369
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
payload/platform/plugins/memory/bin/conversation-archive-ingest.sh View on unpkg payload/server/public/assets/graph-labels-BTFUSc63.js.gz View file • path = [redacted]-labels-BTFUSc63.js.gz
kind = high_entropy_blob
sizeBytes = 9968
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
payload/server/public/assets/graph-labels-BTFUSc63.js.gz View on unpkg • path = [redacted]-labels-BTFUSc63.js.gz
kind = compressed_blob
sizeBytes = 9968
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
payload/server/public/assets/graph-labels-BTFUSc63.js.gz View on unpkg payload/platform/lib/account-enumeration/dist/index.js#virtual:normalized:round1 View file • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 45
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
payload/platform/lib/account-enumeration/dist/index.js#virtual:normalized:round1 View on unpkg • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = dist/uninstall.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/uninstall.js View on unpkg payload/platform/lib/mcp-spawn-tee/dist/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/lib/mcp-spawn-tee/dist/index.js View on unpkg payload/platform/plugins/admin/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/admin/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/admin/skills/_lib/headless.mjs View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]_lib/headless.mjs
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/admin/skills/_lib/headless.mjs View on unpkg payload/platform/plugins/admin/skills/video-production/render.mjs View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-production/render.mjs
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/admin/skills/video-production/render.mjs View on unpkg payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/browser/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/browser/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/cloudflare/bin/portal-index-push.mjs View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-index-push.mjs
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/cloudflare/bin/portal-index-push.mjs View on unpkg payload/platform/plugins/connector/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/connector/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/contacts/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/contacts/lib/mcp-spawn-tee/index.js View on unpkg payload/platform/plugins/dispatch/lib/mcp-spawn-tee/index.js View file • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = [redacted]-spawn-tee/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
payload/platform/plugins/dispatch/lib/mcp-spawn-tee/index.js View on unpkg 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
High Child Process
Package source references child process execution.
dist/index.js View on unpkg · L1 537 // Fetch + dearmor the signing key, write to /etc/apt/trusted.gpg.d/. Pipe
L538: // composition runs through bash -c so the curl|gpg pipeline is one
L539: // privileged command rather than two separate sudo escalations.
1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/index.js View on unpkg · L1 1 Trigger-reachable persistence chain: manifest.bin -> dist/index.js
L1: #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.js View on unpkg · L1 285 function canSudo() {
L286: const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
L287: return result.status === 0;
...
L289: /** True when the npm global prefix's node_modules dir is writable by the current
L290: * user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
L291: function npm[redacted]() {
High Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.js View on unpkg · L285 • matchType = normalized_sha256
matchedPackage = @rubytech/create-maxy-code@0.1.632
matchedPath = dist/index.js
matchedIdentity = npm:[redacted]:0.1.632
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg 1 #!/usr/bin/env node
L2: import { execFileSync, spawn, spawnSync } from "node:child_process";
L3: import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, consta...
...
L9: import { buildBrandCronBlock, mergeBrandCronBlock } from "./cron-registration.js";
L10: import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig, entitlementPath } from "./tier-flag.js";
L11: import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
...
L52: }
L53: const INSTALL_DIR = resolve(process.env.HOME ?? "/root", BRAND.installDir);
L54: const PERSIST_DIR = resolve(process.env.HOME ?? "/root", BRAND.co
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
dist/index.js View on unpkg · L1 10 * two. Before importing, it replaces process.stderr.write with a tee so every
Medium Dynamic Require
Package source references dynamic require/import behavior.
payload/platform/plugins/ledger/lib/mcp-spawn-tee/index.js View on unpkg · L8 11 * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
12 * (the JSON-RPC channel) are never touched.
14 * Claude Code CLI → shim (this file) = node running <real-entry> in-process
15 * stdin/stdout : untouched (JSON-RPC channel)
16 * stderr : process.stderr.write teed → raw sink + passthrough
19 * - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log` — raw stderr + lifecycle lines.
20 * The sole raw sink. Task 1721 retired the per-date twin: its date was
21 * pinned at spawn, no reader ever parsed it, and a since-removed stderr
22 * tee wrote the same file, so every line landed twice.
23 * - `${LOG_DIR}/mcp-<name>-nosession.log` — the same, for a spawn with
24 * no SESSION_ID (enumeration). One fixed file per server.
25 * - `server.log` via the loopback log-ingest route — best-effort mirror of
26 * the [mcp-helper] lifecycle lines.
28 * Lifecycle lines, correlation key `session=<id8> server=<name>`:
=>
{
82 const i = argv. indexOf (flag);
83 return i >= 0 && i + 1 < argv. length ? argv[i + 1 ] : fallback;
86 // Nothing below runs on import, so the two functions above stay unit-testable.
87 const isMain = process.argv[ 1 ] && resolvePath (process.argv[ 1 ]) === resolvePath ( fileURLToPath ( import . meta .url));
88 if (isMain) await main ();
90 async function main () {
91 const archetype = arg ( "--archetype" );
92 const contentPath = arg ( "--content" );
93 const slug = arg ( "--slug" );
94 const outRoot = arg ( "--out" );
95 const brandArg = arg ( "--brand" );
96 const port = arg ( "--port" , "9334" );
97 const T0 = Date. now ();
100 process.env. LOG_DIR && existsSync (process.env. LOG_DIR )
101 ? join (process.env. LOG_DIR , "flow-page.log" )
Low Weak Crypto
Package source references weak cryptographic algorithms.
payload/platform/plugins/admin/skills/flow-page/build.mjs View on unpkg · L99 104 const log = line => {
105 const s = `${ new Date (). toISOString () } ${ line }` ;
107 if ( LOG_FILE ) { try { appendFileSync ( LOG_FILE , s + " \n " ); } catch { /* fail open */ } }
111 const die = line => {
113 if (emitted && existsSync (emitted)) {
114 rmSync (emitted, { force: true });
115 log ( `[flow-page] op=emit-removed slug=${ slug } file=${ emitted }` );
117 log ( `[flow-page] op=exit slug=${ slug } ranMs=${ Date . now () - T0 } outcome=refused` );
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
payload/server/server.js View on unpkg · L358