registry / Data exfiltration / @seele00/seele

@seele00/seele

Browser UI and server runtime for Seele Codex

This report shows the evidence for @seele00/seele@0.1.81. 2 of 10 known versions are blocked or flagged. The newest version, 0.1.92, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Direct inspection found a concrete, undocumented third-party callback mechanism in the shipped executable. No install hook is needed for the runtime data-exfiltration risk to activate.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Running the Seele server and runtime notification/turn activity.

Impact

Potential exfiltration of runtime notification or conversation-associated metadata to an undisclosed third party.

Mechanism

Hard-coded external Profuse callback from the native server runtime.

Attack narrative

When the native Seele server runs, embedded symbols and strings show it can spawn a Profuse notification callback to a hard-coded external endpoint, with instance and notification-related data nearby. This endpoint is absent from the documented proxy and Codex runtime configuration, indicating undisclosed outbound telemetry/exfiltration behavior.

AI rationale

Direct inspection found a concrete, undocumented third-party callback mechanism in the shipped executable. No install hook is needed for the runtime data-exfiltration risk to activate.

Evidence

package.jsonREADME.mdscripts/deploy/bootstrap.shscripts/deploy/start.shlibexec/seele-server

Network endpoints1

profuse.antgroup-inc.cn/api/shao-meta/agent/notify

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

libexec/seele-server hard-codes an external Profuse callback URL.
Binary symbols name profuse_callback and spawn_profuse_notification.
Nearby runtime strings identify notification events and instance_id.
The callback endpoint is undocumented in README and deployment scripts.

Evidence against

package.json has no npm lifecycle hooks.
Bootstrap and proxy actions require explicit CLI commands.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 85 file(s), 5.05 MB of source, external domains: chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, lodash.com, openjsf.org, react.dev, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

9 flagged

web/dist/assets/javascript-wDzz0qaB.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse(`{"displayName":"JavaScript","name":"javascript","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![$_[:alnum:]])(?:(?<=\\\\.\\\\.\\\\.)|(?<!\\\\.))(abstract|declare|override|public|protected|private|readonly|static)(?![$_[:alnum:]])(?:(?=\\\\.\\\\.\\\\.)|(?!\\\\.))","name":"storage.modifier.js"},"after-operator-block-as-object-literal":{"begin":"(?<!\\\\+\\\\+|--)(?<=[!(+,:=>?\\\\[]|^await|[^$._[:alnum:]]await|^return|[^$._[:alnum:]]return|^yield|[^$._[:alnum:]]yield|^throw|[^$ ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/javascript-wDzz0qaB.jsView on unpkg · L1

Long lines were clipped for display.

libexec/seele-serverView file

•path = libexec/seele-server kind = binary_string_ioc sizeBytes = 22354880 magicHex = [redacted] matchedPrintableString = https://profuse.antgroup-inc.cn/api/shao-meta/agent/notify; fields = instance_id, content, messages

Critical

Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

libexec/seele-serverView on unpkg

•path = libexec/seele-server kind = native_binary sizeBytes = 22354880 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

libexec/seele-serverView on unpkg

scripts/deploy/prepare-proxy.shView file

•path = scripts/deploy/prepare-proxy.sh kind = build_helper sizeBytes = 8902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/deploy/prepare-proxy.shView on unpkg

web/dist/assets/cytoscape.esm-DTSO7Bv0.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.693 matchedPath = web-dist/assets/cytoscape.esm-BQaXIfA_.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.693 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

web/dist/assets/cytoscape.esm-DTSO7Bv0.jsView on unpkg

web/dist/assets/diagram-G47NLZAW-Dj8sbBxp.jsView file

•matchType = normalized_sha256 matchedPackage = @seele00/seele@0.1.66 matchedPath = web/dist/assets/diagram-G47NLZAW-CW3IhdcI.js matchedIdentity = npm:QHNlZWxlMDAvc2VlbGU:0.1.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

web/dist/assets/diagram-G47NLZAW-Dj8sbBxp.jsView on unpkg

web/dist/assets/flowDiagram-23GEKE2U-Di3U_AN7.jsView file

•matchType = normalized_sha256 matchedPackage = @seele00/seele@0.1.66 matchedPath = web/dist/assets/flowDiagram-23GEKE2U-dCEvzmf4.js matchedIdentity = npm:QHNlZWxlMDAvc2VlbGU:0.1.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

web/dist/assets/flowDiagram-23GEKE2U-Di3U_AN7.jsView on unpkg

web/dist/assets/wardleyDiagram-EHGQE667-BvSJsS1N.jsView file

•matchType = normalized_sha256 matchedPackage = @seele00/seele@0.1.66 matchedPath = web/dist/assets/wardleyDiagram-EHGQE667-DURrUDRq.js matchedIdentity = npm:QHNlZWxlMDAvc2VlbGU:0.1.66 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

web/dist/assets/wardleyDiagram-EHGQE667-BvSJsS1N.jsView on unpkg

scripts/deploy/start.shView file

•matchType = previous_version_dangerous_delta matchedPackage = @seele00/seele@0.1.75 matchedIdentity = npm:QHNlZWxlMDAvc2VlbGU:0.1.75 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/deploy/start.shView on unpkg

Source & flagged code

9 flagged · loading source

web/dist/assets/javascript-wDzz0qaB.jsView file

1const e=Object.freeze(JSON.parse(`{"displayName":"JavaScript","name":"javascript","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repositor...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/dist/assets/javascript-wDzz0qaB.jsView on unpkg · L1

libexec/seele-serverView file

Critical

Binary String Ioc

Native or WebAssembly artifact printable strings contain known collector or webhook infrastructure.

libexec/seele-serverView on unpkg

•path = libexec/seele-server kind = native_binary sizeBytes = 22354880 magicHex = [redacted]

Findings

1 Critical5 High6 Medium5 Low

CriticalBinary String Ioclibexec/seele-server

HighKnown Malware Source Similarityweb/dist/assets/cytoscape.esm-DTSO7Bv0.js

HighKnown Malware Source Similarityweb/dist/assets/diagram-G47NLZAW-Dj8sbBxp.js

HighKnown Malware Source Similarityweb/dist/assets/flowDiagram-23GEKE2U-Di3U_AN7.js

HighKnown Malware Source Similarityweb/dist/assets/wardleyDiagram-EHGQE667-BvSJsS1N.js

HighPrevious Version Dangerous Deltascripts/deploy/start.sh

MediumDynamic Requireweb/dist/assets/javascript-wDzz0qaB.js

MediumNetwork

MediumProtestware

MediumShips Native Binarylibexec/seele-server

MediumShips Build Helperscripts/deploy/prepare-proxy.sh

Affected versions and remediation

This report applies to @seele00/seele@0.1.81.

The versions list below shows the verdict for each recorded version.

Avoid installing @seele00/seele@0.1.81. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-11 10:26:39.057Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

10 known versions

0.1.92latestSuspiciousAgent extension lifecycle riskWarnPublishedAug 19, 2026, 1:18 AM 0.1.87SuspiciousAI-agent capability abuseWarnPublishedAug 17, 2026, 8:31 AM 0.1.86SuspiciousCredential ExfiltrationWarnPublishedAug 17, 2026, 2:26 AM 0.1.83SuspiciousData ExfiltrationWarnPublishedAug 14, 2026, 3:07 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code