registry / @venos-inc/venos / 0.1.16

@venos-inc/venos@0.1.16

Self-service CLI for venos — wire your AI client to the venos security gateway in one command.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. User-invoked CLI setup can alter supported AI-client configurations and install an optional recurring heartbeat. Enabled commands and hooks collect AI workflow, host, inventory, usage, or selected document data and report it to a user-configured Venos gateway. No unconsented install-time execution or hidden endpoint was established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `venos init`, `heartbeat`, or explicit scan/sync commands; configured AI-client hooks may invoke bundled components.

Impact

A user who configures the tool authorizes broad access to supported AI-client configuration and enabled scan data, plus transmission to the supplied gateway.

Mechanism

Explicit agent configuration, optional heartbeat persistence, and configured-gateway telemetry/policy reporting.

Rationale

The package is not conclusively malicious under the install-control-surface boundary because sensitive actions are user-invoked rather than preinstall/install/postinstall behavior. It warrants a warning for broad AI-agent lifecycle integration, optional persistence, and telemetry collection.

Evidence

package.jsonREADME.mddist/index.jsetc/mcp-server/client.jsetc/mcp-server/wrap-bin.jsetc/mcp-server/wrap.js`~/.venos/config.json``~/.venos/machine-id`AI-client config/rules files under the user's home directoryuser-level systemd unit / Windows Scheduled Task / macOS launchd state

Network endpoints2

caller-supplied `--orchestrator` URL`http://localhost:8788`

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/index.js` wires AI-client MCP/hook/rules configs through explicit `venos init`.
`dist/index.js` stores supplied gateway credentials in `~/.venos/config.json` and reports hooks, usage, inventory, and heartbeat data.
`dist/index.js` optionally creates user-level recurring heartbeat persistence via systemd, Scheduled Tasks, or launchd.
`etc/mcp-server/client.js` uploads user-selected document bytes to the configured Venos API.
`etc/mcp-server/wrap-bin.js` launches an explicitly configured wrapped MCP server and intercepts its tool calls for policy checks.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
No import-time execution: `dist/index.js` is the `venos` bin entrypoint.
Network targets derive from supplied orchestrator configuration; inspected code has no hidden hard-coded third-party collection host.
README documents the sensitive setup and scan behavior as explicit user commands.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 19 file(s), 257 KB of source, external domains: 127.0.0.1, api.openai.com, app.venos.ai, aquasecurity.github.io, chromewebstore.google.com, www.apple.com

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{readFileSync as Lf}from"node:fs";import{homedir as B}from"node:os";import{chmodSync as Cs,existsSync as bs,mkdirSync as qu,readFileSync as Zu,rmSync as Qu,writeFileSync as ed}from"node:fs";import{dirname as td}from"node:path";import{randomBytes as nd}from"node:crypto";import{randomBytes as mi}from"node:crypto";import{execFileSync as gi}from"node:child_process";import{mkdirSync as hi,readFileSync as hn,writeFileSync as yi}from"node:fs";import{homedir as Xf,hostname as ki}from"node:os";import{dirname as vi,join as Si}from"node:path";function C(e,t="/etc/machine-id"){let n=e===""?"":Si(e," ...

3`,"utf8"),r}catch{return""}}function x(e=process.platform,t=wi){if(e==="darwin")try{let n=t().trim();if(n!=="")return n.endsWith(".local")?n:`${n}.local`}catch{}try{let n=ki();return typeof n=="string"?n.trim():""}catch{return""}}function wi(){try{return gi("scutil",["--get","LocalHostName"],{encoding:"utf8",timeout:1e3}).trim()}catch{return""}}import{userInfo as Ci}from"node:os";function Z(){try{let e=Ci().username;if(typeof e=="string"&&e.trim()!=="")return e.trim()}catch{}for(let e of["USER","USERNAME","LOGNAME"]){let t=process.env[e];if(typeof t=="string"&&t.trim()!=="")return t.trim()}ret ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

4`}var fe="http://127.0.0.1:4000/v1";var ji="venos",Hi="venos hook",$i="venos usage-sync",Mi="venos usage-sync --throttle";function wn(e,t){return(e??[]).some(n=>n.hooks.some(r=>typeof r.command=="string"&&t(r.command)))}function dt(e){return

5`,i===t&&(o+=" ".repeat(s+n+2),o+=`^

6`))}return o}var m=class extends Error{line;column;codeblock;constructor(t,n){let[r,o]=Ki(n.toml,n.ptr),s=Vi(n.toml,r,o);super(`Invalid TOML document: ${t}

8${s}`,n),this.line=r,this.column=o,this.codeblock=s}};function Ji(e,t){let n=0;for(;e[t-++n]==="\\";);return--n&&n%2}function Ue(e,t=0,n=e.length){let r=e.indexOf(`

9`,t);return e[r-1]==="\r"&&r--,r<=n?r:-1}function Q(e,t){for(let n=t;n<e.length;n++){let r=e[n];if(r===`

10`)return n;if(r==="\r"&&e[n+1]===`

11`)return n+1;if(r<" "&&r!==" "||r==="\x7F")throw new m("control characters are not allowed in comments",{toml:e,ptr:t})}return e.length}function N(e,t,n,r){let o;for(;;){for(;(o=e[t])===" "||o===" "||!n&&(o===`

12`||o==="\r"&&e[t+1]===`

13`);)t++;if(r||o!=="#")break;t=Q(e,t)}return t}function Pn(e,t,n,r,o=!1){if(!r)return t=Ue(e,t),t<0?e.length:t;for(let s=t;s<e.length;s++){let i=e[s];if(i==="#")s=Ue(e,s);else{if(i===n)return s+1;if(i===r||o&&(i===`

14`||i==="\r"&&e[s+1]===`

15`))return s}}throw new m("cannot find end of structure",{toml:e,ptr:t})}function je(e,t){let n=e[t],r=n===e[t+1]&&e[t+1]===e[t+2]?e.slice(t,t+3):n;t+=r.length-1;do t=e.indexOf(r,++t);while(t>-1&&n!=="'"&&Ji(e,t));return t>-1&&(t+=r.length,r.length>1&&(e[t]===n&&t++,e[t]===n&&t++)),t}var Bi=/^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i,he=class e extends Date{#t=!1;#n=!1;#e=null;constructor(t){let n=!0,r=!0,o="Z";if(typeof t=="string"){let s=t.match(Bi);s?(s[1]||(n=!1,t=`0000-01-01T${t}`),r=!!s[2],r&&t[10]===" "&&(t=t.replace(" ","T")),s[2]&&+s[2]>23? ...

16`,f:"\f",r:"\r",e:"\x1B",'"':'"',"\\":"\\"};function He(e,t=0,n=e.length){let r=e[t]==="'",o=e[t++]

17`&&t++);let s=0,i,a="",c=t;for(;t<n-1;){let l=e[t++];if(l===`

18`||l==="\r"&&e[t]===`

19`){if(!o)throw new m("newlines are not allowed in strings",{toml:e,ptr:t-1})}else if(l<" "&&l!==" "||l==="\x7F")throw new m("control characters are not allowed in strings",{toml:e,ptr:t-1});if(i){if(i=!

20`||l===" "||l===" "||l==="\r")){if(t=N(e,t-1,!0),e[t]!==`

21`&&e[t]!=="\r")throw new m("invalid escape: only line-ending whitespace may be escaped",{toml:e,ptr:s});t=N(e,t)}else if(l in In)a+=In[l];else throw new m("unrecognized escape sequence",{toml:e,ptr:s});c=t}else!r&&l==="\\"&&(s=

Long lines were clipped for display.

Lines 153-193javascript

153 <string>/dev/null</string>

154</dict>

155</plist>

156`}var ro={platform:"darwin",install(e){let t=no(e.home);try{let n=to(t);zc(qc(t),{recursive:!0}),Xc(t,Qc(e.nodePath,e.cliEntry),"utf8");try{e.run("launchctl",["unload",t])}catch{}return e.run("launchctl",["load","-w",t]),re(e.home,{kind:"launchd",path:t}),{platform:"darwin",status:n?"already-installed":"installed",path:t}}catch(n){return{platform:"darwin",status:"error",path:t,error:el(n)}}},remove(e,t){let n=no(e),r=to(n);try{t("launchctl",["unload",n])}catch{}r&&Yc(n,{force:!0});let o=oe(e);return{platform:"darwin",status:r||o?"removed":"already-removed",path:n}}};function el(e){return e ins ...

157Description=venos endpoint heartbeat

158

159[Service]

160Type=oneshot

161ExecStart=${e} ${t

•matchType = previous_version_dangerous_delta matchedPackage = @venos-inc/venos@0.1.15 matchedIdentity = npm:QHZlbm9zLWluYy92ZW5vcw:0.1.15 similarity = 0.611 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

173WantedBy=timers.target L174: `}var co={platform:"linux",install(e){let t=ao(e.home),n=Pe(t,Ve);try{let r=Ke(n);return tl(t,{recursive:!0}),so(Pe(t,io),nl(e.nodePath,e.cliEntry),"utf8"),so(n,rl(),"utf8"),e.run(... L175: `}function El(e,t,n,r){if(r==="win32"){ze(e,`@echo off\r

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L173

1#!/usr/bin/env node L2: import{readFileSync as Lf}from"node:fs";import{homedir as B}from"node:os";import{chmodSync as Cs,existsSync as bs,mkdirSync as qu,readFileSync as Zu,rmSync as Qu,writeFileSync as e... L3: `,"utf8"),r}catch{return""}}function x(e=process.platform,t=wi){if(e==="darwin")try{let n=t().trim();if(n!=="")return n.endsWith(".local")?n:`${n}.local`}catch{}try{let n=ki();retu... L4: `}var fe="http://127.0.0.1:4000/v1";var ji="venos",Hi="venos hook",$i="venos usage-sync",Mi="venos usage-sync --throttle";function wn(e,t){return(e??[]).some(n=>n.hooks.some(r=>typ... ... L45: }); L46: return typeof res.stdout === "string" ? res.stdout : ""; L47: } catch { ... L110: `}var Xn={name:"opencode-hook",transport:"claude-hook",configPath(e){return zn(e,".config","opencode","plugin","venos.js")},isInstalled(e){return bt(zn(e,".config","opencode"))},lo... L111: `)}};import{existsSync as Tt,readFileSync as qa}from"node:fs";import{join as mr}from"node:path";function gr(e){let t=e.mcpServers?.venos;if(!t||t.command!=="node")return!1;let n=t.... L112: # venos-managed cline hook - do not edit; wired by \`venos init\` ... L155: </plist> L156: `}var ro={platform:"darwin",install(e){le

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

Findings

1 Critical4 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

5`,i===t&&(o+=" ".repeat(s+n+2),o+=`^

6`))}return o}var m=class extends Error{line;column;codeblock;constructor(t,n){let[r,o]=Ki(n.toml,n.ptr),s=Vi(n.toml,r,o);super(`Invalid TOML document: ${t}

8${s}`,n),this.line=r,this.column=o,this.codeblock=s}};function Ji(e,t){let n=0;for(;e[t-++n]==="\\";);return--n&&n%2}function Ue(e,t=0,n=e.length){let r=e.indexOf(`

9`,t);return e[r-1]==="\r"&&r--,r<=n?r:-1}function Q(e,t){for(let n=t;n<e.length;n++){let r=e[n];if(r===`

10`)return n;if(r==="\r"&&e[n+1]===`

12`||o==="\r"&&e[t+1]===`

14`||i==="\r"&&e[s+1]===`

16`,f:"\f",r:"\r",e:"\x1B",'"':'"',"\\":"\\"};function He(e,t=0,n=e.length){let r=e[t]==="'",o=e[t++]

17`&&t++);let s=0,i,a="",c=t;for(;t<n-1;){let l=e[t++];if(l===`

18`||l==="\r"&&e[t]===`

20`||l===" "||l===" "||l==="\r")){if(t=N(e,t-1,!0),e[t]!==`

Long lines were clipped for display.

Lines 153-193javascript

153 <string>/dev/null</string>

154</dict>

155</plist>

157Description=venos endpoint heartbeat

158

159[Service]

160Type=oneshot

161ExecStart=${e} ${t

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg