registry / @swarmdo/cli / 1.37.0

@swarmdo/cli@1.37.0

Swarmdo CLI - Enterprise AI agent orchestration with 60+ specialized agents, swarm coordination, MCP server, self-learning hooks, and vector memory for Claude Code

AI Security Review

scanned 8h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Install-time behavior locally patches an AgentDB dependency for compatibility, while Claude configuration changes require an explicit init command.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation runs the postinstall; user invocation of `swarmdo init` writes integration files.

Impact

The postinstall may alter reachable `agentdb/dist` directories; explicit init may create project and optional global Claude configuration.

Mechanism

local AgentDB compatibility copy and user-invoked Claude integration setup

Rationale

Source inspection confirms a broad but package-aligned AgentDB compatibility copy during postinstall, not a payload, exfiltration, remote execution, or AI-agent control-surface hijack. Claude-related writes occur through an explicit CLI init path, so the scanner's lifecycle and dynamic-behavior signals do not establish malicious intent.

Evidence

package.jsonscripts/postinstall.cjsdist/src/init/executor.jsdist/src/commands/init.jsdist/src/services/registry-api.jsnode_modules/agentdb/dist

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with medium false-positive risk.

Evidence for block

`package.json` runs `scripts/postinstall.cjs` at install time.
`scripts/postinstall.cjs` locates reachable `agentdb` installs and copies missing `dist/src` directories into their legacy `dist` paths.

Evidence against

The postinstall script performs only local AgentDB compatibility copying; it contains no network, shell, payload download, or credential collection.
`augmentExports` is defined but not called; the lifecycle path invokes only `copySiblings`.
Claude configuration writes are reached through explicit `swarmdo init`; `dist/src/commands/init.js` exposes `--no-global`.
Registry fetches in `dist/src/services/registry-api.js` are explicit plugin-rating, analytics, health, and download-tracking functions, not install-time behavior.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 576 file(s), 7.78 MB of source, external domains: accounts.google.com, aistudio.google.com, api.anthropic.com, api.npmjs.org, api.openai.com, api.pinata.cloud, api.web3.storage, claude.com, cli.github.com, cloud.google.com, cloudflare-ipfs.com, datasets-server.huggingface.co, dweb.link, example.com, gateway.pinata.cloud, generativelanguage.googleapis.com, git-scm.com, github.com, html.duckduckgo.com, hub.docker.com, huggingface.co, ipfs.io, no-such-registry-9c8c43.example.invalid, nodejs.org, oauth2.googleapis.com, ollama.com, openrouter.ai, pinata.cloud, raw.githubusercontent.com, registry.npmjs.org, sql.js.org, storage.googleapis.com, swarmdo.com, us-central1-swarmdo.cloudfunctions.net, w3s.link, web3.storage, www.apple.com

Source & flagged code

17 flagged

package.jsonView file

Lines 62-102json

62 "./memory": {

63 "types": "./dist/src/memory/memory-initializer.d.ts",

64 "import": "./dist/src/memory/memory-initializer.js"

65 },

66 "./intelligence": {

67 "types": "./dist/src/memory/intelligence.d.ts",

68 "import": "./dist/src/memory/intelligence.js"

69 }

70 },

71 "files": [

72 "dist",

73 "bin",

74 "scripts",

75 ".claude",

76 "plugins",

77 "vendor",

78 "README.md",

79 "LICENSE"

80 ],

81 "scripts": {

82 "postinstall": "node ./scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 },

84 "dependencies": {

85 "@swarmdo/cli-core": "file:vendor/cli-core",

86 "@swarmdo/mcp": "file:vendor/mcp",

87 "@swarmdo/neural": "file:vendor/neural",

88 "@swarmdo/shared": "file:vendor/shared",

89 "@noble/ed25519": "2.3.0",

90 "semver": "7.7.3",

91 "yaml": "^2.8.0",

92 "@swarmvector/rabitq-wasm": "file:vendor/rabitq-wasm"

93 },

94 "optionalDependencies": {

95 "@metaharness/darwin": "~0.3.1",

96 "@metaharness/kernel": "~0.1.0",

97 "@metaharness/router": "~0.3.2",

98 "@swarmdo/memory": "file:vendor/memory",

99 "@swarmvector/sona": "file:vendor/sona",

100 "better-sqlite3": "^12.9.0",

101 "metaharness": "~0.2.6",

102 "sql.js": "^1.13.0"

dist/src/init/statusline-generator.jsView file

Lines 1-38javascript

1/**

2 * Statusline Configuration Generator (Optimized)

3 * Creates fast, reliable statusline for V3 progress display

4 *

5 * Performance:

6 * - Single combined git execSync call (not 8+ separate ones)

7 * - process.memoryUsage() instead of ps aux

8 * - No recursive test file content reading

9 * - Shared settings cache

10 * - Strict 2s timeouts on all shell calls

11 */

12import

dist/src/init/executor.jsView file

Lines 234-292javascript

234 await writeClaudeMd(targetDir, options, result);

235 }

236 // Count enabled hooks

237 result.summary.hooksEnabled = countEnabledHooks(options);

238 }

239 catch (error) {

240 result.success = false;

241 result.errors.

dist/src/commands/security.jsView file

Lines 123-163javascript

123 location: `${path.relative(target, fullPath)}:${i + 1}`,

124 description: type,

125 });

126 pattern.lastIndex = 0;

dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View file

49// 1. Environment variable (fastest path, used in test mocks and CI) L50: const envKey = process.env['GOOGLE_AI_API_KEY']; L51: if (envKey) ... L54: try { L55: const { execSync } = await import('node:child_process'); L56: const key = execSync('gcloud secrets versions access latest --secret=GOOGLE_AI_API_KEY --project=swarm-dev 2>/dev/null', { encoding: 'utf-8', timeout: 5_000 }).trim(); ... L62: } L63: throw new Error("grounded_query: No Google AI API key found.\nSet GOOGLE_AI_API_KEY env var, or ensure `gcloud` is authenticated and\nthe secret GOOGLE_AI_API_KEY exists in GCP pro... L64: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View on unpkg · L49

dist/src/memory/neural-package-bridge.jsView file

38package = @swarmdo/cli; repositoryIdentity = swarmdo; dependency = @swarmdo/neural L38: try { L39: const m = await import('@swarmdo/neural'); L40: const sys = m.createNeuralLearningSystem(mode);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/memory/neural-package-bridge.jsView on unpkg · L38

vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView file

•path = vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasm kind = wasm_module sizeBytes = 71343 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView on unpkg

plugins/swarmdo-metaharness/scripts/smoke.shView file

•path = plugins/swarmdo-metaharness/scripts/smoke.sh kind = build_helper sizeBytes = 124488 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/swarmdo-metaharness/scripts/smoke.shView on unpkg

.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView file

•path = .claude/skills/sdo-caveman-compress/scripts/benchmark.py kind = payload_in_excluded_dir sizeBytes = 2433 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView on unpkg

dist/src/changelog/changelog.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @swarmdo/cli@1.29.0 matchedIdentity = npm:QHN3YXJtZG8vY2xp:1.29.0 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/changelog/changelog.jsView on unpkg

.claude/agents/sparc/refinement.mdView file

339patternName = generic_password severity = medium line = 339 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L339

367patternName = generic_password severity = medium line = 367 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L367

543patternName = generic_password severity = medium line = 543 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L543

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/init/statusline-generator.jsView file

85const path = require('path'); L86: const { execSync } = require('child_process'); L87: const os = require('os');

High

Child Process

Package source references child process execution.

dist/src/init/statusline-generator.jsView on unpkg · L85

222? '"' + process.execPath + '" "' + cliBin + '" hooks statusline --json 2>/dev/null' L223: : 'npx --prefer-offline @swarmdo/cli hooks statusline --json 2>/dev/null'; L224: const raw = execSync( L225: cmd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/init/statusline-generator.jsView on unpkg · L222

18* install with custom prefix, pnpm content-addressable layout, etc.). Walks up L19: * from this module's location until it finds a package.json whose name is L20: * `@swarmdo/cli`. Works in both the src tree (under tsx) and the compiled dist ... L32: try { L33: const pkg = JSON.parse(fs.readFileSync(candidate, 'utf-8')); L34: if (pkg.name === '@swarmdo/cli' && typeof pkg.version === 'string' && pkg.version.length > 0) { ... L85: const path = require('path'); L86: const { execSync } = require('child_process'); L87: const os = require('os'); ... L98: // SWARMDO_STATUSLINE_HIDE_COST 1/true/yes/on removes the segment entirely. L99: costSymbol: process.env.SWARMDO_STATUSLINE_COST_SYMBOL ?? '$', L100: hideCost: /^(1|true|yes|on)$/i.test(process.env.SWARMDO_STATUSLINE_HIDE_COST || ''),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/src/init/statusline-generator.jsView on unpkg · L18

dist/src/init/executor.jsView file

254// Platform-specific command wrappers L255: // Windows: Use PowerShell-compatible commands L256: // Mac/Linux: Use bash-compatible commands with 2>/dev/null

High

Shell

Package source references shell execution.

dist/src/init/executor.jsView on unpkg · L254

272// Uses node -e with git rev-parse so hooks work regardless of CWD (#1259, #1284). L273: const gitRootResolver = "var c=require('child_process'),p=require('path'),u=require('url'),r;" L274: + "try{r=c.execSync('git rev-parse --show-toplevel',{encoding:'utf8'}).trim()}"

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/init/executor.jsView on unpkg · L272

dist/src/commands/security.jsView file

143const codePatterns = [ L144: { pattern: /eval\s*\(/g, type: 'Eval Usage', severity: 'medium', desc: 'eval() can execute arbitrary code' }, L145: { pattern: /innerHTML\s*=/g, type: 'innerHTML', severity: 'medium', desc: 'XSS risk with innerHTML' },

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/commands/security.jsView on unpkg · L143

dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View on unpkg · L49

dist/src/memory/neural-package-bridge.jsView file

38package = @swarmdo/cli; repositoryIdentity = swarmdo; dependency = @swarmdo/neural L38: try { L39: const m = await import('@swarmdo/neural'); L40: const sys = m.createNeuralLearningSystem(mode);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/memory/neural-package-bridge.jsView on unpkg · L38

vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView file

•path = vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasm kind = wasm_module sizeBytes = 71343 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView on unpkg

plugins/swarmdo-metaharness/scripts/smoke.shView file

•path = plugins/swarmdo-metaharness/scripts/smoke.sh kind = build_helper sizeBytes = 124488 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/swarmdo-metaharness/scripts/smoke.shView on unpkg

.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView file

•path = .claude/skills/sdo-caveman-compress/scripts/benchmark.py kind = payload_in_excluded_dir sizeBytes = 2433 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView on unpkg

dist/src/changelog/changelog.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/changelog/changelog.jsView on unpkg

.claude/agents/sparc/refinement.mdView file

339patternName = generic_password severity = medium line = 339 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L339

367patternName = generic_password severity = medium line = 367 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L367

543patternName = generic_password severity = medium line = 543 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L543

Findings

1 Critical7 High11 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/src/changelog/changelog.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/src/init/statusline-generator.js

HighShelldist/src/init/executor.js

HighSame File Env Network Executiondist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1

HighCopied Package Dependency Bridgedist/src/memory/neural-package-bridge.js

HighRuntime Package Installdist/src/init/statusline-generator.js

HighPayload In Excluded Dir.claude/skills/sdo-caveman-compress/scripts/benchmark.py

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/src/init/executor.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/src/init/statusline-generator.js

MediumShips Wasm Modulevendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasm

MediumShips Build Helperplugins/swarmdo-metaharness/scripts/smoke.sh

MediumStructural Risk Force Deep Review

MediumSecret Pattern.claude/agents/sparc/refinement.md

LowScripts Present

LowEvaldist/src/commands/security.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

17 flagged

package.jsonView file

Lines 62-102json

62 "./memory": {

63 "types": "./dist/src/memory/memory-initializer.d.ts",

64 "import": "./dist/src/memory/memory-initializer.js"

65 },

66 "./intelligence": {

67 "types": "./dist/src/memory/intelligence.d.ts",

68 "import": "./dist/src/memory/intelligence.js"

69 }

70 },

71 "files": [

72 "dist",

73 "bin",

74 "scripts",

75 ".claude",

76 "plugins",

77 "vendor",

78 "README.md",

79 "LICENSE"

80 ],

81 "scripts": {

82 "postinstall": "node ./scripts/postinstall.cjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L82

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L82

83 },

84 "dependencies": {

85 "@swarmdo/cli-core": "file:vendor/cli-core",

86 "@swarmdo/mcp": "file:vendor/mcp",

87 "@swarmdo/neural": "file:vendor/neural",

88 "@swarmdo/shared": "file:vendor/shared",

89 "@noble/ed25519": "2.3.0",

90 "semver": "7.7.3",

91 "yaml": "^2.8.0",

92 "@swarmvector/rabitq-wasm": "file:vendor/rabitq-wasm"

93 },

94 "optionalDependencies": {

95 "@metaharness/darwin": "~0.3.1",

96 "@metaharness/kernel": "~0.1.0",

97 "@metaharness/router": "~0.3.2",

98 "@swarmdo/memory": "file:vendor/memory",

99 "@swarmvector/sona": "file:vendor/sona",

100 "better-sqlite3": "^12.9.0",

101 "metaharness": "~0.2.6",

102 "sql.js": "^1.13.0"

dist/src/init/statusline-generator.jsView file

Lines 1-38javascript

1/**

2 * Statusline Configuration Generator (Optimized)

3 * Creates fast, reliable statusline for V3 progress display

4 *

5 * Performance:

6 * - Single combined git execSync call (not 8+ separate ones)

7 * - process.memoryUsage() instead of ps aux

8 * - No recursive test file content reading

9 * - Shared settings cache

10 * - Strict 2s timeouts on all shell calls

11 */

12import

dist/src/init/executor.jsView file

Lines 234-292javascript

234 await writeClaudeMd(targetDir, options, result);

235 }

236 // Count enabled hooks

237 result.summary.hooksEnabled = countEnabledHooks(options);

238 }

239 catch (error) {

240 result.success = false;

241 result.errors.

dist/src/commands/security.jsView file

Lines 123-163javascript

123 location: `${path.relative(target, fullPath)}:${i + 1}`,

124 description: type,

125 });

126 pattern.lastIndex = 0;

dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View on unpkg · L49

dist/src/memory/neural-package-bridge.jsView file

38package = @swarmdo/cli; repositoryIdentity = swarmdo; dependency = @swarmdo/neural L38: try { L39: const m = await import('@swarmdo/neural'); L40: const sys = m.createNeuralLearningSystem(mode);

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/src/memory/neural-package-bridge.jsView on unpkg · L38

vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView file

•path = vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasm kind = wasm_module sizeBytes = 71343 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/rabitq-wasm/swarmvector_rabitq_wasm_bg.wasmView on unpkg

plugins/swarmdo-metaharness/scripts/smoke.shView file

•path = plugins/swarmdo-metaharness/scripts/smoke.sh kind = build_helper sizeBytes = 124488 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/swarmdo-metaharness/scripts/smoke.shView on unpkg

.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView file

•path = .claude/skills/sdo-caveman-compress/scripts/benchmark.py kind = payload_in_excluded_dir sizeBytes = 2433 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/sdo-caveman-compress/scripts/benchmark.pyView on unpkg

dist/src/changelog/changelog.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/changelog/changelog.jsView on unpkg

.claude/agents/sparc/refinement.mdView file

339patternName = generic_password severity = medium line = 339 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L339

367patternName = generic_password severity = medium line = 367 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L367

543patternName = generic_password severity = medium line = 543 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L543