Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@runuai/host@0.8.5: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as AI-agent capability risk

Allowed by default with warning: agent-facing configuration or capability changes need review before use.

View on npm All versions Policy details

registry / @runuai/host / 0.8.5

@runuai/host@0.8.5

Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Operator runs `uai-host setup`/`run` and authorizes tasks or MCP connections.

Impact

Authorized task agents can act with configured credentials and bypass interactive agent permission prompts inside their containers.

Mechanism

Cloud-controlled Docker agents with credential injection and host-side MCP proxying.

Rationale

The package is not malicious by source evidence, but it deliberately provides a high-impact remote AI-agent execution and credential-proxy capability. Downgrade to warn rather than block because activation is explicit and no covert malicious chain was established.

Evidence

package.jsonbin/uai-host.mjssrc/cli.tssrc/main.tslib/agents/grok.tslib/codex-auth.tslib/mcp-gateway.tsscripts/install/darwin.tsscripts/install/linux.tsscripts/install/win.ts~/.codex/home/node/.codex/config.toml.uai/cli.mjs.uai/uai.json

Network endpoints3

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

ws://127.0.0.1:8789/hosthost.docker.internal:5877github.com/winsw/winsw/releases/download/v2.12.0/WinSW-x64.exe

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`lib/agents/grok.ts` launches Grok in a task container with `--permission-mode bypassPermissions`.
`lib/codex-auth.ts` copies the operator's `~/.codex` credentials into running task containers.
`src/main.ts` opens a persistent configured cloud WebSocket bridge and starts task orchestration.
`lib/mcp-gateway.ts` proxies task-container MCP traffic using host-held OAuth/token credentials.
`scripts/install/*` creates user service persistence, but only through explicit CLI install commands.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`src/cli.ts` requires explicit `setup`, `run`, or `install` commands; import entrypoint only loads the CLI.
`lib/mcp-gateway.ts` requires per-task ACL tokens and keeps MCP credentials host-side.
No `eval`, VM, native loader, obfuscated payload, or hidden network endpoint was found.
Windows download is an explicit installer action for the named WinSW release URL.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 60 file(s), 507 KB of source, external domains: 127.0.0.1, github.com, host.docker.internal, www.apple.com

Source & flagged code

4 flagged · loading source

bin/uai-host.mjsView file

13register(); L14: await import(new URL("../src/cli.ts", import.meta.url).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/uai-host.mjsView on unpkg · L13

scripts/install/darwin.tsView file

4* Writes ~/Library/LaunchAgents/com.runuai.host.plist (KeepAlive + RunAtLoad), L5: * logs to ~/Library/Logs/Uai/, loads with `launchctl bootstrap gui/<uid>`. L6: * The service's PATH is the operator's PATH at install time (so node/pnpm/ ... L21: const target = `${domain}/${LABEL}`; L22: const logDir = resolve(homedir(), "Library", "Logs", "Uai"); L23: ... L80: cwd: ctx.cwd, L81: path: process.env.PATH ?? "", L82: home: homedir(),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install/darwin.tsView on unpkg · L4

scripts/agent/task-status.shView file

•path = scripts/agent/task-status.sh kind = build_helper sizeBytes = 1752 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent/task-status.shView on unpkg

lib/agents/grok.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @runuai/host@0.8.1 matchedIdentity = npm:QHJ1bnVhaS9ob3N0:0.8.1 similarity = 0.946 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/agents/grok.tsView on unpkg

Findings

1 High6 Medium4 Low

HighPrevious Version Dangerous Deltalib/agents/grok.ts

MediumDynamic Requirebin/uai-host.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/install/darwin.ts

MediumShips Build Helperscripts/agent/task-status.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

AuthorDiogo Perillo

Maintainersrockorama

Version0.8.6

PublishedJul 17, 2026

LicenseMIT

Dependencies7

Integrityverified

Package size185 KB

Files86

Keywordsaicoding-agentclaudecodexdockerdev-containerself-hostedorchestrator

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsexports mapbin → uai-host

Runtimenode >=20

Artifact596 KB · 86 files1 signature(s)

Install lifecycleNo install hooks · other: lint, start, test:unit, typecheck +1

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocketHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

bin/uai-host.mjsView file

Lines 1-15javascript

1#!/usr/bin/env node

2/**

3 * Published entrypoint for `@runuai/host` (ADR-032).

4 *

5 * The host ships TypeScript source and runs it through tsx — no build step —

6 * so every runtime path (drizzle migrations, scripts/agent/*.sh, the

7 * images/standard build context) resolves off its source file exactly as in

8 * dev. This shim registers tsx's ESM loader, then hands off to src/cli.ts.

9 * argv passes straight through: src/cli.ts reads process.argv.slice(2).

10 */

11import { register } from "tsx/esm/api";

12

13register();

14await import(new URL("../src/cli.ts", import.meta.url).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/uai-host.mjsView on unpkg · L13

15

scripts/install/darwin.tsView file

Lines 1-24typescript

1/**

2 * macOS service install via launchd (ADR-028).

3 *

4 * Writes ~/Library/LaunchAgents/com.runuai.host.plist (KeepAlive + RunAtLoad),

5 * logs to ~/Library/Logs/Uai/, loads with `launchctl bootstrap gui/<uid>`.

6 * The service's PATH is the operator's PATH at install time (so node/pnpm/

7 * docker/git resolve); .env.local is loaded by the host process itself.

8 */

9

10import { mkdirSync, rmSync, writeFileSync } from

scripts/agent/task-status.shView file

•path = scripts/agent/task-status.sh kind = build_helper sizeBytes = 1752 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/agent/task-status.shView on unpkg

lib/agents/grok.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @runuai/host@0.8.1 matchedIdentity = npm:QHJ1bnVhaS9ob3N0:0.8.1 similarity = 0.946 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/agents/grok.tsView on unpkg

"node:fs"

;

11import { homedir } from "node:os";

12import { dirname, resolve } from "node:path";

13

14import type { InstallContext, Installer } from "./types";

15import { escapeXml, printFile, step } from "./util";

16

17export const LABEL = "com.runuai.host";

18

19const uid = process.getuid?.() ?? 0;

20const domain = `gui/${uid}`;

21const target = `${domain}/${LABEL}`;

22const logDir = resolve(homedir(), "Library", "Logs", "Uai");

23

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/install/darwin.tsView on unpkg · L4

24export function plistPath(): string {