registry / aims-workstation / 0.1.29
aims-workstation@0.1.29
AIMS 工作站：本地智能体工作站——ARM 助手本地化（下载/离线/升级）、工作台对话式定制、多工作区隔离、分级自主与审计
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe default LAN binding combined with open-by-default API authentication creates an unauthenticated access risk for the workstation and its agent features. This is a suspicious security exposure rather than evidence of malicious intent.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Start the server with the default host and no access token configured.
Impact
Other reachable LAN clients may use the workstation API and its configured services or agent capabilities without the operator's approval.
Mechanism
The server binds to 0.0.0.0, and its API authentication check allows requests when no token is set. The chat endpoint accepts requests that can invoke configured agents.
AI rationale
The default LAN binding combined with open-by-default API authentication creates an unauthenticated access risk for the workstation and its agent features. This is a suspicious security exposure rather than evidence of malicious intent.
Evidence
server.jsREADME.md
Network endpoints1
0.0.0.0:5600
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The server binds to 0.0.0.0 by default, making it reachable on the local network.
- When no access token is configured, the authentication check permits requests.
- The /api/chat route accepts client-supplied messages, agent IDs, and autonomy levels.
- The README documents the LAN-accessible default and a localhost-only override.
- The manifest has no install lifecycle hook; the exposure begins when the server is started.
Evidence against
- The package describes itself as a workstation intended for team use.
- Authentication can be enabled with an access token.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
9 flaggedserver.jsView file
6// 覆盖所有出站 fetch（ARM REST、LLM、面板代理）。本工具面向内网/本机使用。
L7: process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
L8: const http = require('http');
L9: const fs = require('fs');
...
L23: // ── 代码与数据分离：包目录只放代码与只读资产；全部运行时状态在 AIMS_HOME（缺省 ~/.aims-workstation）──
L24: const PKG_ROOT = __dirname;
L25: const AIMS_HOME = process.env.AIMS_HOME ? path.resolve(process.env.AIMS_HOME) : path.join(os.homedir(), '.aims-workstation');
...
L61: try {
L62: const local = JSON.parse(fs.readFileSync(to, 'utf8'));
L63: const seed = JSON.parse(fs.readFileSync(path.join(seedDir, f), 'utf8'));
...
L98: // ro=只读白名单命令名（免确认直行）；sudo_u_l2=true 时 `sudo -u <用户>` 降权形式不再永久拒绝、按写命令走 L2 人工确认（裸 sudo 仍拒绝）
L99: // 默认清单按平台合成：POSIX 为主；Windows（cmd/PowerShell 命令与毁灭性命令）仅在 win32 追加——非 Windows 平台不引入 "format" 等词的误杀
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
server.jsView on unpkg · L66Trigger-reachable chain: scripts.start -> server.js
L6: // 覆盖所有出站 fetch（ARM REST、LLM、面板代理）。本工具面向内网/本机使用。
L7: process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
L8: const http = require('http');
L9: const fs = require('fs');
...
L23: // ── 代码与数据分离：包目录只放代码与只读资产；全部运行时状态在 AIMS_HOME（缺省 ~/.aims-workstation）──
L24: const PKG_ROOT = __dirname;
L25: const AIMS_HOME = process.env.AIMS_HOME ? path.resolve(process.env.AIMS_HOME) : path.join(os.homedir(), '.aims-workstation');
...
L61: try {
L62: const local = JSON.parse(fs.readFileSync(to, 'utf8'));
L63: const seed = JSON.parse(fs.readFileSync(path.join(seedDir, f), 'utf8'));
...
L98: // ro=只读白名单命令名（免确认直行）；sudo_u_l2=true 时 `sudo -u <用户>` 降权形式不再永久拒绝、按写命令走 L2 人工确认（裸 sudo 仍拒绝）
L99: // 默认清单按平台合成：POSIX 为主；Windows（cmd/PowerShell 命令与毁灭性命令）仅在 win32 追加——非 Windows
Findings
3 Critical5 High4 Medium6 Low
CriticalCredential Exfiltrationserver.js
CriticalTrigger Reachable Dangerous Capabilityserver.js
CriticalPrevious Version Dangerous Deltaserver.js
HighCredential Redirect Persistenceserver.js
HighTrigger Reachable External Ai Agent Control Surface Mutationserver.js
HighTrigger Reachable Credential Exfiltrationserver.js
HighKnown Malware Source Similarityserver.js
HighKnown Malware Source Fingerprint Signatureserver.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/publish-npm.sh
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to aims-workstation@0.1.29.
See all versions of aims-workstation for other recorded verdicts.
- Review the evidence and your use of aims-workstation@0.1.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.