registry / Data exfiltration / arcroom
arcroom
Shared team memory and run control for coding agents: Claude Code, Codex, Cursor, OpenCode
This report shows the evidence for arcroom@0.0.1-beta. 1 of 6 known versions is blocked or flagged. The newest version, 0.0.5-beta, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiOnce configured, the package automatically sends the machine hostname with agent run events to its vendor’s API. The README discloses other uploaded run data but does not mention hostname collection, so this is undisclosed collection of machine-identifying information.
Static reason
One or more suspicious static signals were detected.
Trigger
After the user runs arcroom init, configured agent hooks process lifecycle events and start the uploader.
Impact
The service receives identifying information about the user’s machine without that collection being disclosed in the package’s data-use description.
Mechanism
Event construction adds hostname() and the working directory; the daemon sends event batches to the configured API, defaulting to https://api.arcroomai.com.
Attack narrative
After explicit setup, agent hooks automatically record the machine hostname in run events. The daemon uploads those events to the ArcRoom API. The README describes other uploaded run data but omits hostname collection, making this undisclosed collection of machine-identifying data a data exfiltration finding.
AI rationale
Once configured, the package automatically sends the machine hostname with agent run events to its vendor’s API. The README discloses other uploaded run data but does not mention hostname collection, so this is undisclosed collection of machine-identifying information.
Evidence
dist/events.jsdist/hook.jsdist/daemon.jsdist/home.jsREADME.md~/.arcroom/spool.jsonl
Network endpoints1
api.arcroomai.com
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- Each run event includes the machine hostname and the hook payload’s working directory.
- The hook converts agent lifecycle events into ArcRoom events, and the daemon uploads event batches to the configured API.
- The default upload destination is https://api.arcroomai.com.
- The README describes uploaded prompts, paths, commands, and other run data but does not disclose collection of the machine hostname.
Evidence against
- Runtime hooks are installed only after the user runs the documented init command.
- The README discloses collection of several kinds of run data and describes an arcroom off command.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/fresh.jsView file
53const r = git(['ls-files', '--cached', '--others', '--exclude-standard'], { cwd, timeout: 1500 });
L54: files = r.status === 0 ? (r.stdout ?? '').split('\n').filter(Boolean).slice(0, MAX_SCAN) : [];
L55: return files;
Low
dist/home.jsView file
11const rel = custom && isAbsolute(custom) ? relative(cwd, custom) : '';
L12: return custom && isAbsolute(custom) && (rel.startsWith('..') || isAbsolute(rel)) ? custom : join(homedir(), '.arcroom');
L13: }
L14: export const ARCROOM_HOME = homeFrom(process.env.ARCROOM_HOME, process.cwd());
L15: // Repos where this person switched ArcRoom off (arcroom off): no tracing, no lookups, nothing leaves the laptop (I6).
...
L19: try {
L20: return JSON.parse(readFileSync(file, 'utf8'));
L21: }
...
L35: }
L36: // ArcRoom API (the Oracle server behind Caddy). A local API: arcroom init --url http://localhost:8787
L37: export const DEFAULT_URL = 'https://api.arcroomai.com';
...
L59: headers: { Authorization: `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' },
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
dist/home.jsView on unpkg · L11Findings
4 High2 Medium6 Low
HighHost Fingerprint Exfiltrationdist/home.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/init.js
HighAi Review Evidencedist/events.js
HighSuspicious Lifecycle Evidencedist/hook.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/fresh.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to arcroom@0.0.1-beta.
The versions list below shows the verdict for each recorded version.
- Avoid installing arcroom@0.0.1-beta. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.