@spinabot/brigade@1.29.5: AI-agent control-surface risk

Loading npm security reports…

@spinabot/brigade@1.29.5: AI-agent control-surface risk | LPM Firewall

Source & flagged code

18 flagged

package.jsonView file

Lines 38-78json

38 "scripts/run-brigade.mjs",

39 "scripts/build-done.mjs",

40 "scripts/install-convex.mjs",

41 "scripts/convex-dev.mjs",

42 "scripts/convex-push.mjs",

43 "scripts/brand-oauth-page.mjs",

44 "scripts/assets/brigade-logo.webp",

45 "scripts/assets/brigade-favicon.ico",

46 "dist/**/*",

47 "templates/**/*",

48 "skills/**/*",

49 "convex/**/*.ts",

50 "convex/_generated/**",

51 "convex/tsconfig.json",

52 "README.md",

53 "LICENSE"

54 ],

55 "scripts": {

56 "build": "tsc -p tsconfig.build.json",

57 "postbuild": "node scripts/build-done.mjs",

58 "postinstall": "node scripts/brand-oauth-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 "build:watch": "tsc -p tsconfig.build.json --watch",

60 "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",

61 "prepack": "npm run build",

62 "test": "node scripts/run-tests.mjs",

63 "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",

64 "typecheck": "tsc -p tsconfig.json --noEmit",

65 "brigade": "node brigade.mjs",

66 "start": "node scripts/run-brigade.mjs",

67 "dev": "node scripts/run-brigade.mjs",

68 "dev:tsx": "tsx src/entry.ts",

69 "watch": "tsx --watch src/entry.ts",

70 "onboard": "node scripts/run-brigade.mjs onboard",

71 "login": "node scripts/run-brigade.mjs login",

72 "login:bin": "node brigade.mjs login",

73 "auth": "node scripts/run-brigade.mjs auth",

74 "onboard:bin": "node brigade.mjs onboard",

75 "onboard:watch": "tsx --watch src/entry.ts onboard",

76 "agent": "node scripts/run-brigade.mjs agent",

77 "agent:bin": "node brigade.mjs agent",

78 "agent:watch": "tsx --watch src/entry.ts agent",

dist/ui/onboarding.jsView file

Lines 1-34javascript

1/**

2 * First-run onboarding wizard.

3 *

4 * Flow:

5 * 1. Welcome screen

6 * 2. Provider picker (SelectList of curated providers)

7 * 3. API key entry (or detect existing env var)

8 * 4. Model picker (SelectList of models for that provider)

9 * 5. Persist to AuthStorage + Brigade config

10 * 6. Return chosen { provider, modelId }

11 *

dist/ui/clipboard.jsView file

Lines 1-38javascript

1/**

2 * The clipboard, as a first-class cross-platform capability.

3 *

4 * ── Why this is its own module ────────────────────────────────────────────

5 * Reading a clipboard is not one problem, it is four, and they do not share an

6 * answer across operating systems:

7 *

8 * • an IMAGE (a screenshot) lives on the clipboard as raw bitmap data with no

9 * file behind it — the bytes must be materialised somewhere before anything

10 * else can touch them;

dist/agents/org/pride-image.jsView file

Lines 70-110javascript

70 format: "png",

71 rasterized: true,

72 width: png.width,

73 height: png.height,

74 hash,

75 cached: false

brigade.mjsView file

Lines 34-74javascript

34 const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(process.versions.node);

35 if (!m) return;

dist/agents/tool-loop-detector.jsView file

Lines 1-21javascript

1/**

2 * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

3 * tool with the same arguments over and over. A real failure mode: the

4 * model emits `read({path: "src/foo.ts"})` 30 times in a row, burning

5 * turns and tokens without making progress.

6 *

7 * Two levels of escalation:

8 *

dist/core/daemon/systemd.jsView file

Lines 1-28javascript

1/**

2 * Linux systemd-user adapter.

3 *

4 * Writes `~/.config/systemd/user/brigade-gateway.service` and runs

5 * `systemctl --user daemon-reload && enable --now`. `Restart=on-failure`

6 * makes the supervisor restart the daemon if it crashes; the unit auto-starts

7 * at user login (lingering = a separate operator decision).

8 */

9import { spawn } from "node:child_process"

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View file

42const env = { L43: ...process.env, L44: BRIGADE_CONVEX_BIN_DIR: binDir, ... L50: // already downloaded). Fail fast if the install step errors. L51: const install = spawnSync(process.execPath, [join(pkgRoot, "scripts", "install-convex.mjs")], { L52: env, ... L57: // 2) Boot the backend + dashboard in the foreground. L58: process.stdout.write("Starting Convex (data: ${friendlyPath(dataDir)})\n backend → http://${DEFAULT_HOST}:${DEFAULT_PORT}\n dashboard → http://${DEFAULT_HOST}:${DASHBOARD_PORT}... L59: const child = spawn(process.execPath, [join(pkgRoot, "scripts", "convex-dev.mjs")], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View on unpkg · L42

dist/cli/commands/convex-cmd.jsView file

75// already downloaded). Fail fast if the install step errors. L76: const install = spawnSync(process.execPath, [join(pkgRoot, "scripts", "install-convex.mjs")], { L77: env, ... L82: // 2) Boot the backend + dashboard in the foreground. L83: process.stdout.write(`Starting Convex (data: ${friendlyPath(dataDir)})\n` + L84: ` backend → http://${DEFAULT_HOST}:${DEFAULT_PORT}\n` + L85: ` dashboard → http://${DEFAULT_HOST}:${DASHBOARD_PORT}\n` +

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

6* scripts inside the package, so this works both from a repo checkout and from L7: * a global `npm i -g` install (any cwd). The actual work lives in the L8: * `scripts/*.mjs` orchestrators; this command resolves the package root + the ... L20: */ L21: import { spawn, spawnSync } from "node:child_process"; L22: import { existsSync, readFileSync, unlinkSync } from "node:fs";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/convex-cmd.jsView on unpkg · L6

dist/infra/net/fetch-guard.jsView file

4* Why this exists: Brigade runs LLM-controllable URLs through `fetch`. L5: * Without a guard, a model can be tricked into hitting `http://169.254.169.254/` L6: * (cloud metadata) or `http://localhost:1234/` (developer service) and ... L20: import { isIP, isIPv4, isIPv6 } from "node:net"; L21: import { promises as dnsPromises } from "node:dns"; L22: import { DEFAULT_TIMEOUT_SECONDS } from "../../agents/tools/web-shared.js"; ... L28: * Cloud-metadata + forbidden-literal hosts that stay blocked EVEN WHEN L29: * `allowPrivateNetwork` is set — these are never a legitimate LAN target and are L30: * the highest-value SSRF destinations. ... L364: headers: currentHeaders, L365: body: currentBody ?? undefined, L366: redirect: "manual",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/core/tunnel/providers/bore.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.29.1 matchedPath = dist/core/tunnel/providers/bore.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.29.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/core/tunnel/providers/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.29.1 matchedPath = [redacted].js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.29.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/cloudflared.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.29.1 matchedPath = dist/agents/extensions/install-scan.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.29.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.29.1 matchedPath = dist/agents/extensions/install.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.29.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/brand-oauth-page.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/ui/onboarding.jsView file

14*/ L15: import { spawn } from "node:child_process"; L16: import { getModels } from "@earendil-works/pi-ai";

High

Child Process

Package source references child process execution.

dist/ui/onboarding.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.29.1 matchedPath = dist/ui/onboarding.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.29.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/onboarding.jsView on unpkg

dist/ui/clipboard.jsView file

18* Each platform expresses all four differently, so they live behind one L19: * `ClipboardBackend` and the rest of the product never learns that PowerShell, L20: * osascript, or wl-paste exist.

High

Shell

Package source references shell execution.

dist/ui/clipboard.jsView on unpkg · L18

dist/agents/org/pride-image.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/org/pride-image.jsView on unpkg

90// consistent with how Brigade lazy-loads other heavy modules.) L91: const importer = new Function("s", "return import(s)"); L92: const mod = (await importer("playwright-core"));

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/agents/org/pride-image.jsView on unpkg · L90

brigade.mjsView file

54try { L55: const mod = await import("node:module"); L56: if (typeof mod.enableCompileCache === "function" && !process.env.NODE_DISABLE_COMPILE_CACHE) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

brigade.mjsView on unpkg · L54

dist/agents/tool-loop-detector.jsView file

1/** L2: * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

dist/core/daemon/systemd.jsView file

8*/ L9: import { spawn } from "node:child_process"; L10: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L14: function unitPath() { L15: return path.join(os.homedir(), ".config", "systemd", "user", SERVICE_UNIT_NAME); L16: } ... L36: "RestartSec=2", L37: `StandardOutput=append:${ctx.stdoutPath}`, L38: `StandardError=append:${ctx.stderrPath}`, ... L74: if (r.code !== 0) { L75: return { ok: false, message: `systemctl enable failed: ${r.stderr.trim()}`, unitPath: file }; L76: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/daemon/systemd.jsView on unpkg · L8

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View on unpkg · L42

dist/cli/commands/convex-cmd.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/convex-cmd.jsView on unpkg · L6

dist/infra/net/fetch-guard.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/core/tunnel/providers/bore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/core/tunnel/providers/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/cloudflared.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

Source & flagged code

18 flagged

package.jsonView file

Lines 38-78json

38 "scripts/run-brigade.mjs",

39 "scripts/build-done.mjs",

40 "scripts/install-convex.mjs",

41 "scripts/convex-dev.mjs",

42 "scripts/convex-push.mjs",

43 "scripts/brand-oauth-page.mjs",

44 "scripts/assets/brigade-logo.webp",

45 "scripts/assets/brigade-favicon.ico",

46 "dist/**/*",

47 "templates/**/*",

48 "skills/**/*",

49 "convex/**/*.ts",

50 "convex/_generated/**",

51 "convex/tsconfig.json",

52 "README.md",

53 "LICENSE"

54 ],

55 "scripts": {

56 "build": "tsc -p tsconfig.build.json",

57 "postbuild": "node scripts/build-done.mjs",

58 "postinstall": "node scripts/brand-oauth-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 "build:watch": "tsc -p tsconfig.build.json --watch",

60 "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",

61 "prepack": "npm run build",

62 "test": "node scripts/run-tests.mjs",

63 "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",

64 "typecheck": "tsc -p tsconfig.json --noEmit",

65 "brigade": "node brigade.mjs",

66 "start": "node scripts/run-brigade.mjs",

67 "dev": "node scripts/run-brigade.mjs",

68 "dev:tsx": "tsx src/entry.ts",

69 "watch": "tsx --watch src/entry.ts",

70 "onboard": "node scripts/run-brigade.mjs onboard",

71 "login": "node scripts/run-brigade.mjs login",

72 "login:bin": "node brigade.mjs login",

73 "auth": "node scripts/run-brigade.mjs auth",

74 "onboard:bin": "node brigade.mjs onboard",

75 "onboard:watch": "tsx --watch src/entry.ts onboard",

76 "agent": "node scripts/run-brigade.mjs agent",

77 "agent:bin": "node brigade.mjs agent",

78 "agent:watch": "tsx --watch src/entry.ts agent",

dist/ui/onboarding.jsView file

Lines 1-34javascript

1/**

2 * First-run onboarding wizard.

3 *

4 * Flow:

5 * 1. Welcome screen

6 * 2. Provider picker (SelectList of curated providers)

7 * 3. API key entry (or detect existing env var)

8 * 4. Model picker (SelectList of models for that provider)

9 * 5. Persist to AuthStorage + Brigade config

10 * 6. Return chosen { provider, modelId }

11 *

dist/ui/clipboard.jsView file

Lines 1-38javascript

1/**

2 * The clipboard, as a first-class cross-platform capability.

3 *

4 * ── Why this is its own module ────────────────────────────────────────────

5 * Reading a clipboard is not one problem, it is four, and they do not share an

6 * answer across operating systems:

7 *

8 * • an IMAGE (a screenshot) lives on the clipboard as raw bitmap data with no

9 * file behind it — the bytes must be materialised somewhere before anything

10 * else can touch them;

dist/agents/org/pride-image.jsView file

Lines 70-110javascript

70 format: "png",

71 rasterized: true,

72 width: png.width,

73 height: png.height,

74 hash,

75 cached: false

brigade.mjsView file

Lines 34-74javascript

34 const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(process.versions.node);

35 if (!m) return;

dist/agents/tool-loop-detector.jsView file

Lines 1-21javascript

1/**

2 * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

3 * tool with the same arguments over and over. A real failure mode: the

4 * model emits `read({path: "src/foo.ts"})` 30 times in a row, burning

5 * turns and tokens without making progress.

6 *

7 * Two levels of escalation:

8 *

dist/core/daemon/systemd.jsView file

Lines 1-28javascript

1/**

2 * Linux systemd-user adapter.

3 *

4 * Writes `~/.config/systemd/user/brigade-gateway.service` and runs

5 * `systemctl --user daemon-reload && enable --now`. `Restart=on-failure`

6 * makes the supervisor restart the daemon if it crashes; the unit auto-starts

7 * at user login (lingering = a separate operator decision).

8 */

9import { spawn } from "node:child_process"

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View on unpkg · L42

dist/cli/commands/convex-cmd.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/convex-cmd.jsView on unpkg · L6

dist/infra/net/fetch-guard.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

dist/core/tunnel/providers/bore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/core/tunnel/providers/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/cloudflared.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

@spinabot/brigade@1.29.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code