Loading npm security reports…

agenticros@0.6.9: Malicious npm security report (Block) | LPM Firewall

registry / agenticros / 0.6.9

agenticros@0.6.9

AgenticROS - agentic AI for ROS-powered robots. Single CLI to launch real-robot or simulated demos, manage configuration, and inspect status.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

A user who runs agenticros connect starts a persistent cloud-connected process with a remote shell-command handler. No inbound authentication or command validation is present before execution.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit agenticros connect command or menu Connect action.

Impact

Remote code execution on the connected robot host; associated channel can command motion and exfiltrate camera images.

Mechanism

Socket event data passed directly to child_process.exec.

Attack narrative

After an explicit connect action, the CLI detaches the shipped comms.js process. That process authenticates to the AgenticROS cloud signaling endpoint, then registers a bash-script event handler that executes its received data as a shell command without validation or authorization checks. A controlling signaling service or an attacker able to emit that event can execute arbitrary commands on the robot host; the same connection also handles robot motion and camera responses.

Rationale

The shipped runtime contains a concrete remote-command execution path, not merely a risky primitive. Its explicit-user trigger does not remove the arbitrary server-supplied shell execution.

Evidence

package.jsondist/commands/robot-hw.jsruntime/packages/agenticros-robot/comms.jsruntime/packages/agenticros-robot/ros-topics.js

Network endpoints2

wss://cloud.agenticros.com

Source & flagged code

11 flagged · loading source

dist/util/mcp-discovery.jsView file

16*/ L17: import { spawn } from "node:child_process"; L18: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

dist/util/workspace.jsView file

11import { join } from "node:path"; L12: import { execa } from "execa"; L13: import { info, ok, warn, withSpinner } from "./logger.js";

High

Shell

Package source references shell execution.

dist/util/workspace.jsView on unpkg · L11

dist/commands/skills-dev.jsView file

89}; L90: const require = createRequire(pathToFileURL(entryPath).href); L91: const mod = require(entryPath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/commands/skills-dev.jsView on unpkg · L89

dist/util/marketplace.jsView file

3* L4: * The marketplace itself is at https://sk[redacted] — this CLI L5: * talks to the REST endpoints exposed under /api/ (rewritten by Firebase ... L12: import { dirname, basename, join, resolve } from "node:path"; L13: import { execa } from "execa"; L14: import { discoveryRoots } from "./skills.js"; ... L16: export function apiBase() { L17: return (process.env.AGENTICROS_SKILLS_API || DEFAULT_API_BASE).replace(/\/+$/, ""); L18: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/util/marketplace.jsView on unpkg · L3

runtime/scripts/check-cli-tarball-install.mjsView file

197L198: // 6. pnpm install with the same flags init.ts uses L199: step("Running pnpm install with init.ts flags (this can take a minute)..."); L200: const installResult = spawnSync( L201: "pnpm",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

runtime/scripts/check-cli-tarball-install.mjsView on unpkg · L197

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/packages/core/src/memory/local/provider.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/packages/core/src/memory/local/provider.tsView on unpkg

runtime/packages/agenticros-robot/comms.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agenticros@0.5.8 matchedIdentity = npm:YWdlbnRpY3Jvcw:0.5.8 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/packages/agenticros-robot/comms.jsView on unpkg

Source & flagged code

11 flagged

dist/util/mcp-discovery.jsView file

Lines 1-36javascript

1/**

2 * Bridge from the CLI to the AgenticROS MCP server's `ros2_discover_robots` tool.

3 *

4 * Rather than re-implement live-topic discovery in the CLI (which would

5 * force `@agenticros/core` and its transport deps into the published

6 * `agenticros` tarball), we spawn the existing MCP server binary

7 * (`packages/agenticros-claude-code/dist/index.js`) and JSON-RPC the

8 * `ros2_discover_robots` tool — the exact code path Claude Code uses.

9 * This keeps the CLI light AND ensures the CLI sees the same robots

10 * the agent sees.

11 *

12 * Resilience: the spawn-and-rpc dance is wrapped in an overall timeout

13 * so a hung Zenoh router or a malformed reply can't lock up the CLI.

14 * The stderr stream is drained silently — the MCP server emits a

15 * connection banner that isn't useful for the CLI consumer.

16 */

17import { spawn } from "node:child_process";

18import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/util/mcp-discovery.jsView on unpkg · L16

19import { join } from "node:path";

20import { getCliPaths } from "./paths.js";

21const DISCOVER_TIMEOUT_MS = 15_000;

22const INIT_TIMEOUT_MS = 8_000;

23/**

24 * Resolve the path to the AgenticROS MCP server entrypoint, mirroring

25 * the same lookup the rest of the CLI uses. Returns undefined when the

26 * dist hasn't been built yet (so the caller can surface an actionable

27 * error rather than a cryptic spawn failure).

28 */

29export function findMcpEntry() {

30 const { mcpDistDir } = getCliPaths();

31 const entry = join(mcpDistDir, "index.js");

32 return existsSync(entry) ? entry : undefined;

33}

34/** Minimal stdio JSON-RPC client over a child process. */

35class StdioRpc {

36 proc;

dist/util/workspace.jsView file

Lines 1-31javascript

1/**

2 * Workspace bring-up helpers used by `agenticros init` and any runner that

3 * needs the JS workspace built before it can launch (currently `up real`;

4 * sim runners don't need TS deps).

5 *

6 * Why shared: across 0.1.2 .. 0.1.6 we kept hitting "user picks Launch

7 * without running init first" failures. Rather than asking the user to

8 * pick the right menu item, we just auto-recover.

9 */

10import { existsSync, writeFileSync }

dist/commands/skills-dev.jsView file

Lines 69-109javascript

69 logger: {

70 info: (...m) => console.log("[skill]", ...m),

71 warn: (...m) => console.warn

dist/util/marketplace.jsView file

Lines 1-23javascript

1/**

2 * Tiny client for the AgenticROS Skills marketplace REST API.

3 *

4 * The marketplace itself is at https://skills.agenticros.com — this CLI

5 * talks to the REST endpoints exposed under /api/ (rewritten by Firebase

6 * Hosting to the `api` Cloud Function). Read-only, no auth.

7 *

8 * Override the base URL via `AGENTICROS_SKILLS_API` for local emulator

9 * testing or staging deployments.

10 */

11

runtime/scripts/check-cli-tarball-install.mjsView file

Lines 177-217javascript

177 }

178 ok(`All ${REQUIRED_RUNTIME_FILES.length} critical runtime files present.`);

179

180 // 4. simulate init: cp -a runtime/. installDir/

181 step("Copying runtime/ into a fresh install dir (simulating `agenticros init`)...");

182 run

runtime/scripts/start_demo.shView file

•path = runtime/scripts/start_demo.sh kind = build_helper sizeBytes = 3490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

runtime/scripts/start_demo.shView on unpkg

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView file

•path = [redacted]-agenticros-0.0.1.tgz kind = high_entropy_blob sizeBytes = 115903 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = compressed_blob sizeBytes = 115903 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

•path = [redacted]-agenticros-0.0.1.tgz kind = nested_archive_needs_inspection sizeBytes = 115903 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

runtime/packages/agenticros/agenticros-agenticros-0.0.1.tgzView on unpkg

runtime/packages/core/src/memory/local/provider.tsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

runtime/packages/core/src/memory/local/provider.tsView on unpkg

runtime/packages/agenticros-robot/comms.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = agenticros@0.5.8 matchedIdentity = npm:YWdlbnRpY3Jvcw:0.5.8 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

runtime/packages/agenticros-robot/comms.jsView on unpkg