@spinabot/brigade@1.36.1: AI-agent control-surface risk

Loading npm security reports…

@spinabot/brigade@1.36.1: AI-agent control-surface risk | LPM Firewall

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

The automatic postinstall hook executes a script that alters another package's OAuth callback page.
The hook resolves the PI AI OAuth module, embeds Brigade-controlled image data, changes the callback-page title, and writes the result back.
This occurs during installation without a user command or OAuth-flow consent.

Evidence against

The inspected postinstall script contains no outbound network request or credential collection.
The mutation is limited to a named dependency callback page rather than a broad filesystem scan.
Other inspected daemon, tunnel, extension, and Discord features are activated through runtime commands, not postinstall.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 738 file(s), 8.51 MB of source, external domains: 127.0.0.1, 192.168.1.5, accounts.google.com, aistudio.google.com, api-dashboard.search.brave.com, api.anthropic.com, api.cerebras.ai, api.deepgram.com, api.deepseek.com, api.dev.runwayml.com, api.duckduckgo.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.firecrawl.dev, api.github.com, api.groq.com, api.minimax.io, api.mistral.ai, api.moonshot.ai, api.openai.com, api.orcarouter.ai, api.perplexity.ai, api.sarvam.ai, api.search.brave.com, api.slack.com, api.tavily.com, api.telegram.org, api.together.xyz, api.x.ai, api.z.ai, app.tavily.com, ark.ap-southeast.bytepluses.com, bailian.console.alibabacloud.com, brave.com, brigade.spinabot.com, build.nvidia.com, chatgpt.com, claude.ai, cloud.cerebras.ai, console.anthropic.com, console.groq.com, console.mistral.ai, console.x.ai, core.telegram.org, dashscope-intl.aliyuncs.com, discord.com, docs.exa.ai, docs.firecrawl.dev, docs.github.com

Oversized source lightweight scan

dist/ui/brand-frames-cli.js2.36 MB file, sampled 256 KB

Minified

Source & flagged code

27 flagged

package.jsonView file

Lines 38-78json

38 "scripts/run-brigade.mjs",

39 "scripts/build-done.mjs",

40 "scripts/install-convex.mjs",

41 "scripts/convex-dev.mjs",

42 "scripts/convex-push.mjs",

43 "scripts/brand-oauth-page.mjs",

44 "scripts/assets/brigade-logo.webp",

45 "scripts/assets/brigade-favicon.ico",

46 "dist/**/*",

47 "templates/**/*",

48 "skills/**/*",

49 "convex/**/*.ts",

50 "convex/_generated/**",

51 "convex/tsconfig.json",

52 "README.md",

53 "LICENSE"

54 ],

55 "scripts": {

56 "build": "tsc -p tsconfig.build.json",

57 "postbuild": "node scripts/build-done.mjs",

58 "postinstall": "node scripts/brand-oauth-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 "build:watch": "tsc -p tsconfig.build.json --watch",

60 "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",

61 "prepack": "npm run build",

62 "test": "node scripts/run-tests.mjs",

63 "test:mutation": "node scripts/mutation-check.mjs",

64 "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",

65 "typecheck": "tsc -p tsconfig.json --noEmit",

66 "brigade": "node brigade.mjs",

67 "start": "node scripts/run-brigade.mjs",

68 "dev": "node scripts/run-brigade.mjs",

69 "dev:tsx": "tsx src/entry.ts",

70 "watch": "tsx --watch src/entry.ts",

71 "onboard": "node scripts/run-brigade.mjs onboard",

72 "login": "node scripts/run-brigade.mjs login",

73 "login:bin": "node brigade.mjs login",

74 "auth": "node scripts/run-brigade.mjs auth",

75 "onboard:bin": "node brigade.mjs onboard",

76 "onboard:watch": "tsx --watch src/entry.ts onboard",

77 "agent": "node scripts/run-brigade.mjs agent",

78 "agent:bin": "node brigade.mjs agent",

dist/ui/onboarding.jsView file

Lines 1-34javascript

1/**

2 * First-run onboarding wizard.

3 *

4 * Flow:

5 * 1. Welcome screen

6 * 2. Provider picker (SelectList of curated providers)

7 * 3. API key entry (or detect existing env var)

8 * 4. Model picker (SelectList of models for that provider)

9 * 5. Persist to AuthStorage + Brigade config

10 * 6. Return chosen { provider, modelId }

11 *

dist/ui/clipboard.jsView file

Lines 1-38javascript

1/**

2 * The clipboard, as a first-class cross-platform capability.

3 *

4 * ── Why this is its own module ────────────────────────────────────────────

5 * Reading a clipboard is not one problem, it is four, and they do not share an

6 * answer across operating systems:

7 *

8 * • an IMAGE (a screenshot) lives on the clipboard as raw bitmap data with no

9 * file behind it — the bytes must be materialised somewhere before anything

10 * else can touch them;

dist/agents/org/pride-image.jsView file

Lines 70-110javascript

70 format: "png",

71 rasterized: true,

72 width: png.width,

73 height: png.height,

74 hash,

75 cached: false

brigade.mjsView file

Lines 34-74javascript

34 const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(process.versions.node);

35 if (!m) return;

dist/agents/tool-loop-detector.jsView file

Lines 1-21javascript

1/**

2 * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

3 * tool with the same arguments over and over. A real failure mode: the

4 * model emits `read({path: "src/foo.ts"})` 30 times in a row, burning

5 * turns and tokens without making progress.

6 *

7 * Two levels of escalation:

8 *

dist/core/daemon/systemd.jsView file

Lines 1-28javascript

1/**

2 * Linux systemd-user adapter.

3 *

4 * Writes `~/.config/systemd/user/brigade-gateway.service` and runs

5 * `systemctl --user daemon-reload && enable --now`. `Restart=on-failure`

6 * makes the supervisor restart the daemon if it crashes; the unit auto-starts

7 * at user login (lingering = a separate operator decision).

8 */

9import { spawn } from "node:child_process"

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View file

42const env = { L43: ...process.env, L44: BRIGADE_CONVEX_BIN_DIR: binDir, ... L50: // already downloaded). Fail fast if the install step errors. L51: const install = spawnSync(process.execPath, [join(pkgRoot, "scripts", "install-convex.mjs")], { L52: env, ... L57: // 2) Boot the backend + dashboard in the foreground. L58: process.stdout.write("Starting Convex (data: ${friendlyPath(dataDir)})\n backend → http://${DEFAULT_HOST}:${DEFAULT_PORT}\n dashboard → http://${DEFAULT_HOST}:${DASHBOARD_PORT}... L59: const child = spawn(process.execPath, [join(pkgRoot, "scripts", "convex-dev.mjs")], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View on unpkg · L42

dist/cli/commands/convex-cmd.jsView file

75// already downloaded). Fail fast if the install step errors. L76: const install = spawnSync(process.execPath, [join(pkgRoot, "scripts", "install-convex.mjs")], { L77: env, ... L82: // 2) Boot the backend + dashboard in the foreground. L83: process.stdout.write(`Starting Convex (data: ${friendlyPath(dataDir)})\n` + L84: ` backend → http://${DEFAULT_HOST}:${DEFAULT_PORT}\n` + L85: ` dashboard → http://${DEFAULT_HOST}:${DASHBOARD_PORT}\n` +

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

75Trigger-reachable command-output exfiltration chain: manifest.main -> dist/entry.js -> dist/cli/run-main.js -> dist/cli/program/build-program.js -> dist/cli/commands/convex-cmd.js L75: // already downloaded). Fail fast if the install step errors. L76: const install = spawnSync(process.execPath, [join(pkgRoot, "scripts", "install-convex.mjs")], { L77: env, ... L82: // 2) Boot the backend + dashboard in the foreground. L83: process.stdout.write(`Starting Convex (data: ${friendlyPath(dataDir)})\n` + L84: ` backend → http://${DEFAULT_HOST}:${DEFAULT_PORT}\n` + L85: ` dashboard → http://${DEFAULT_HOST}:${DASHBOARD_PORT}\n` +

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

6* scripts inside the package, so this works both from a repo checkout and from L7: * a global `npm i -g` install (any cwd). The actual work lives in the L8: * `scripts/*.mjs` orchestrators; this command resolves the package root + the ... L20: */ L21: import { spawn, spawnSync } from "node:child_process"; L22: import { existsSync, readFileSync, unlinkSync } from "node:fs";

dist/infra/net/fetch-guard.jsView file

4* Why this exists: Brigade runs LLM-controllable URLs through `fetch`. L5: * Without a guard, a model can be tricked into hitting `http://169.254.169.254/` L6: * (cloud metadata) or `http://localhost:1234/` (developer service) and ... L20: import { isIP, isIPv4, isIPv6 } from "node:net"; L21: import { promises as dnsPromises } from "node:dns"; L22: import { DEFAULT_TIMEOUT_SECONDS } from "../../agents/tools/web-shared.js"; ... L28: * Cloud-metadata + forbidden-literal hosts that stay blocked EVEN WHEN L29: * `allowPrivateNetwork` is set — these are never a legitimate LAN target and are L30: * the highest-value SSRF destinations. ... L364: headers: currentHeaders, L365: body: currentBody ?? undefined, L366: redirect: "manual",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

dist/core/daemon/launchd.jsView file

4Trigger-reachable persistence chain: manifest.main -> dist/entry.js -> dist/cli/run-main.js -> dist/cli/program/build-program.js -> dist/cli/commands/gateway-install.js -> dist/core/daemon/service.js -> dist/core/daemon/launchd.js L4: * Writes `~/Library/LaunchAgents/com.brigade.gateway.plist` (a user agent, no L5: * sudo needed) and loads it via `launchctl bootstrap gui/$UID`. `KeepAlive` L6: * makes the OS restart the daemon if it crashes; `RunAtLoad` brings it up at ... L8: */ L9: import { spawn } from "node:child_process"; L10: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L14: function plistPath() { L15: return path.join(os.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`); L16: } ... L39: ` <key>WorkingDirectory</key><str

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/daemon/launchd.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/core/daemon/launchd.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/launchd.jsView on unpkg

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

brigade.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 44

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

brigade.mjs#virtual:normalized:round1View on unpkg

dist/cli/commands/doctor.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/cli/commands/doctor.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/doctor.jsView on unpkg

dist/core/tunnel/providers/bore.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/core/tunnel/providers/bore.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/core/tunnel/providers/cloudflared.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = [redacted].js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/cloudflared.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/agents/extensions/install-scan.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/agents/extensions/install.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

dist/agents/tools/render-video/availability.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/agents/tools/render-video/availability.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/tools/render-video/availability.jsView on unpkg

dist/core/daemon/schtasks.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/core/daemon/schtasks.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/schtasks.jsView on unpkg

dist/cli/commands/exec-node.jsView file

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/cli/commands/exec-node.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/exec-node.jsView on unpkg

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/brand-oauth-page.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/ui/onboarding.jsView file

14*/ L15: import { spawn } from "node:child_process"; L16: import { getModels } from "@earendil-works/pi-ai";

High

Child Process

Package source references child process execution.

dist/ui/onboarding.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/ui/onboarding.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/onboarding.jsView on unpkg

dist/ui/clipboard.jsView file

18* Each platform expresses all four differently, so they live behind one L19: * `ClipboardBackend` and the rest of the product never learns that PowerShell, L20: * osascript, or wl-paste exist.

High

Shell

Package source references shell execution.

dist/ui/clipboard.jsView on unpkg · L18

•matchType = normalized_sha256 matchedPackage = @spinabot/brigade@1.34.0 matchedPath = dist/ui/clipboard.js matchedIdentity = npm:QHNwaW5hYm90L2JyaWdhZGU:1.34.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/clipboard.jsView on unpkg

dist/agents/org/pride-image.jsView file

90// consistent with how Brigade lazy-loads other heavy modules.) L91: const importer = new Function("s", "return import(s)"); L92: const mod = (await importer("playwright-core"));

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/agents/org/pride-image.jsView on unpkg · L90

brigade.mjsView file

54try { L55: const mod = await import("node:module"); L56: if (typeof mod.enableCompileCache === "function" && !process.env.NODE_DISABLE_COMPILE_CACHE) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

brigade.mjsView on unpkg · L54

dist/agents/tool-loop-detector.jsView file

1/** L2: * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

dist/core/daemon/systemd.jsView file

8*/ L9: import { spawn } from "node:child_process"; L10: import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs"; ... L14: function unitPath() { L15: return path.join(os.homedir(), ".config", "systemd", "user", SERVICE_UNIT_NAME); L16: } ... L36: "RestartSec=2", L37: `StandardOutput=append:${ctx.stdoutPath}`, L38: `StandardError=append:${ctx.stderrPath}`, ... L74: if (r.code !== 0) { L75: return { ok: false, message: `systemctl enable failed: ${r.stderr.trim()}`, unitPath: file }; L76: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/core/daemon/systemd.jsView on unpkg · L8

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View on unpkg · L42

dist/cli/commands/convex-cmd.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

dist/infra/net/fetch-guard.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

dist/core/daemon/launchd.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/daemon/launchd.jsView on unpkg · L4

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/launchd.jsView on unpkg

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

brigade.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 44

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

brigade.mjs#virtual:normalized:round1View on unpkg

dist/cli/commands/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/doctor.jsView on unpkg

dist/core/tunnel/providers/bore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/core/tunnel/providers/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/cloudflared.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

dist/agents/tools/render-video/availability.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/tools/render-video/availability.jsView on unpkg

dist/core/daemon/schtasks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/schtasks.jsView on unpkg

dist/cli/commands/exec-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/exec-node.jsView on unpkg

Source & flagged code

27 flagged

package.jsonView file

Lines 38-78json

38 "scripts/run-brigade.mjs",

39 "scripts/build-done.mjs",

40 "scripts/install-convex.mjs",

41 "scripts/convex-dev.mjs",

42 "scripts/convex-push.mjs",

43 "scripts/brand-oauth-page.mjs",

44 "scripts/assets/brigade-logo.webp",

45 "scripts/assets/brigade-favicon.ico",

46 "dist/**/*",

47 "templates/**/*",

48 "skills/**/*",

49 "convex/**/*.ts",

50 "convex/_generated/**",

51 "convex/tsconfig.json",

52 "README.md",

53 "LICENSE"

54 ],

55 "scripts": {

56 "build": "tsc -p tsconfig.build.json",

57 "postbuild": "node scripts/build-done.mjs",

58 "postinstall": "node scripts/brand-oauth-page.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

59 "build:watch": "tsc -p tsconfig.build.json --watch",

60 "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",

61 "prepack": "npm run build",

62 "test": "node scripts/run-tests.mjs",

63 "test:mutation": "node scripts/mutation-check.mjs",

64 "bench": "npx tsx --test src/agents/memory/eval/comparison.test.ts src/agents/memory/eval/gold-hard.test.ts src/agents/memory/eval/gold-parity.test.ts src/agents/memory/eval/asr-bench.test.ts",

65 "typecheck": "tsc -p tsconfig.json --noEmit",

66 "brigade": "node brigade.mjs",

67 "start": "node scripts/run-brigade.mjs",

68 "dev": "node scripts/run-brigade.mjs",

69 "dev:tsx": "tsx src/entry.ts",

70 "watch": "tsx --watch src/entry.ts",

71 "onboard": "node scripts/run-brigade.mjs onboard",

72 "login": "node scripts/run-brigade.mjs login",

73 "login:bin": "node brigade.mjs login",

74 "auth": "node scripts/run-brigade.mjs auth",

75 "onboard:bin": "node brigade.mjs onboard",

76 "onboard:watch": "tsx --watch src/entry.ts onboard",

77 "agent": "node scripts/run-brigade.mjs agent",

78 "agent:bin": "node brigade.mjs agent",

dist/ui/onboarding.jsView file

Lines 1-34javascript

1/**

2 * First-run onboarding wizard.

3 *

4 * Flow:

5 * 1. Welcome screen

6 * 2. Provider picker (SelectList of curated providers)

7 * 3. API key entry (or detect existing env var)

8 * 4. Model picker (SelectList of models for that provider)

9 * 5. Persist to AuthStorage + Brigade config

10 * 6. Return chosen { provider, modelId }

11 *

dist/ui/clipboard.jsView file

Lines 1-38javascript

1/**

2 * The clipboard, as a first-class cross-platform capability.

3 *

4 * ── Why this is its own module ────────────────────────────────────────────

5 * Reading a clipboard is not one problem, it is four, and they do not share an

6 * answer across operating systems:

7 *

8 * • an IMAGE (a screenshot) lives on the clipboard as raw bitmap data with no

9 * file behind it — the bytes must be materialised somewhere before anything

10 * else can touch them;

dist/agents/org/pride-image.jsView file

Lines 70-110javascript

70 format: "png",

71 rasterized: true,

72 width: png.width,

73 height: png.height,

74 hash,

75 cached: false

brigade.mjsView file

Lines 34-74javascript

34 const m = /^v?(\d+)\.(\d+)\.(\d+)/.exec(process.versions.node);

35 if (!m) return;

dist/agents/tool-loop-detector.jsView file

Lines 1-21javascript

1/**

2 * Tool-loop detector — catches the model when it's stuck calling the same

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agents/tool-loop-detector.jsView on unpkg · L1

3 * tool with the same arguments over and over. A real failure mode: the

4 * model emits `read({path: "src/foo.ts"})` 30 times in a row, burning

5 * turns and tokens without making progress.

6 *

7 * Two levels of escalation:

8 *

dist/core/daemon/systemd.jsView file

Lines 1-28javascript

1/**

2 * Linux systemd-user adapter.

3 *

4 * Writes `~/.config/systemd/user/brigade-gateway.service` and runs

5 * `systemctl --user daemon-reload && enable --now`. `Restart=on-failure`

6 * makes the supervisor restart the daemon if it crashes; the unit auto-starts

7 * at user login (lingering = a separate operator decision).

8 */

9import { spawn } from "node:child_process"

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/commands/convex-cmd.js#virtual:normalized:round1View on unpkg · L42

dist/cli/commands/convex-cmd.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli/commands/convex-cmd.jsView on unpkg · L75

dist/infra/net/fetch-guard.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/infra/net/fetch-guard.jsView on unpkg · L4

dist/core/daemon/launchd.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/core/daemon/launchd.jsView on unpkg · L4

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/launchd.jsView on unpkg

skills/video-frames/scripts/frame.shView file

•path = skills/video-frames/scripts/frame.sh kind = build_helper sizeBytes = 1347 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/video-frames/scripts/frame.shView on unpkg

brigade.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 44

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

brigade.mjs#virtual:normalized:round1View on unpkg

dist/cli/commands/doctor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/doctor.jsView on unpkg

dist/core/tunnel/providers/bore.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/bore.jsView on unpkg

dist/core/tunnel/providers/cloudflared.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/tunnel/providers/cloudflared.jsView on unpkg

dist/agents/extensions/install-scan.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install-scan.jsView on unpkg

dist/agents/extensions/install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/extensions/install.jsView on unpkg

dist/agents/tools/render-video/availability.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/agents/tools/render-video/availability.jsView on unpkg

dist/core/daemon/schtasks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/daemon/schtasks.jsView on unpkg

dist/cli/commands/exec-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/commands/exec-node.jsView on unpkg

@spinabot/brigade@1.36.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code