registry  /  bossmode  /  0.14.0

bossmode@0.14.0

Discord-style AI team chat room

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Observed network, child_process, filesystem, and MCP behavior is aligned with a user-started local AI team chat daemon.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs `bossmode on` or uses authenticated local web/API features
Impact
Local app state and credentials are stored under ~/.bossmode; no source-grounded credential harvesting or exfiltration found
Mechanism
local daemon, bundled web UI, optional user-configured MCP and Linear integrations
Rationale
Static source inspection found a local AI collaboration application with user-invoked daemon startup and package-aligned integrations, not install-time execution, exfiltration, persistence, or unconsented AI-agent control-surface mutation. Scanner findings map to legitimate local server/MCP/editor functionality and bundled frontend code.
Evidence
package.jsondist/cli/index.jsdist/server/index.jsdist/server/daemon.jsdist/shared/config.jsdist/shared/mcp-settings.jsdist/integrations/linear-client.jsweb/dist/assets/index-Bqvtcf0G.js~/.bossmode/config.json~/.bossmode/bossmode.pid~/.bossmode/bossmode.log~/.bossmode/mcp/mcp.json
Network endpoints3
127.0.0.1:8080localhost:8080api.linear.app/graphql

Decision evidence

public snapshot
AI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json has no install/preinstall/postinstall lifecycle hooks; bin is user-invoked ./dist/cli/index.js
    • dist/cli/index.js forks only bundled dist/server/daemon.js after `bossmode on`, with host/port env and log file
    • dist/server/index.js starts a local HTTP/WebSocket app and serves bundled web/dist; default bind is 127.0.0.1:8080
    • dist/shared/config.js stores config, password hash, and PID under BOSSMODE_DIR/~/.bossmode with local file permissions
    • dist/shared/mcp-settings.js writes scoped MCP configs under ~/.bossmode/mcp and disables deferred MCP capabilities before use
    • web/dist scanner hits are bundled editor/parser code and syntax modes, not observed remote download/execute behavior
    Behavioral surface
    Source
    ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
    Supply chain
    HighEntropyStringsMinifiedObfuscatedUrlStrings
    ManifestNo manifest risk signals triggered.
    scanned 225 file(s), 4.83 MB of source, external domains: 10.8.0.24, api.example.com, api.example.invalid, api.linear.app, codesandbox.io, github.com, json-schema.org, lea.verou.me, lexical.dev, nodebox-runtime.codesandbox.io, opensource.org, preview.sandpack-static-server.codesandbox.io, radix-ui.com, react.dev, vitejs.dev, www.w3.org

    Source & flagged code

    4 flagged · loading source
    dist/cli/index.jsView file
    1#!/usr/bin/env node L2: import { fork } from "node:child_process"; L3: import { openSync, readFileSync } from "node:fs";
    High
    Child Process

    Package source references child process execution.

    dist/cli/index.jsView on unpkg · L1
    web/dist/assets/index-Bqvtcf0G.jsView file
    8]|$)`},{atBreak:!0,character:"<",after:"[!/?A-Za-z]"},{character:"<",after:"[!/?A-Za-z]",inConstruct:"phrasing",notInConstruct:Ja},{character:"<",inConstruct:"destinationLiteral"},... L9: `)&&u.type==="html"&&(s[s.length-1]=s[s.length-1].replace(/(\r?\n|\r)$/," "),a=" ",c=e.createTracker(n),c.move(s.join("")));let f=e.handle(u,t,e,{...c.current(),after:h,before:a});... L10: `,after:` ... L20: `,now:{line:1,column:1},lineShift:0});return i&&i.charCodeAt(i.length-1)!==10&&i.charCodeAt(i.length-1)!==13&&(i+=` L21: `),i;function s(o){return r.stack.push(o),a;function a(){r.stack.pop()}}}function ZZ(t){throw new Error("Cannot handle value `"+t+"`, expected node")}function zZ(t){const e=t;throw... L22: ... L43: L44: `))}return r.pop(),a.join("")}function jI(t){let e=0,n=t.stack.length;for(;--n>-1;){const r=t.stack[n];if(r==="blockquote"||r==="listItem")break;r==="mdxJsxFlowElement"&&e++}return... L45: `));var e=[],n=t.split(/(\n|\r\n)/);n[n.length-1]||n.pop();for(var r=0;r<n.length;r++){var i=n[r];r%2&&!this.options.newlineIsToken?e[e.length-1]+=i:(this.options.ignoreWhitespace&... ... L147: `+t.slice(o+1):l+=t.slice(i),l.slice(1)}function jie(t){for(var e="",n=0,r,i=0;i<t.length;n
    Critical
    Download Execute

    Source downloads or fetches remote code and executes it.

    web/dist/assets/index-Bqvtcf0G.jsView on unpkg · L8
    897} L898: `,aOe={defaultPreset:"react",presets:[{name:"react",meta:"live react",label:"React",sandpackTemplate:"react",sandpackTheme:"light",snippetFileName:"/App.js",snippetLanguage:"jsx",i... L899: `:r=="r"?"\r":r=="t"?" ":"\\")}eq(e){return this.search==e.search&&this.replace==e.replace&&this.caseSensitive==e.caseSensitive&&this.regexp==e.regexp&&this.wholeWord==e.wholeWord&...
    High
    Shell

    Package source references shell execution.

    web/dist/assets/index-Bqvtcf0G.jsView on unpkg · L897
    web/dist/assets/livescript-BwQOo05w.jsView file
    1var f=function(e,n){var g=n.next||"start";{n.next=n.next;var k=x[g];if(k.splice){for(var l=0;l<k.length;++l){var t=k[l];if(t.regex&&e.match(t.regex))return n.next=t.next||n.next,t....
    Medium
    Dynamic Require

    Package source references dynamic require/import behavior.

    web/dist/assets/livescript-BwQOo05w.jsView on unpkg · L1

    Findings

    1 Critical2 High4 Medium5 Low
    CriticalDownload Executeweb/dist/assets/index-Bqvtcf0G.js
    HighChild Processdist/cli/index.js
    HighShellweb/dist/assets/index-Bqvtcf0G.js
    MediumDynamic Requireweb/dist/assets/livescript-BwQOo05w.js
    MediumNetwork
    MediumEnvironment Vars
    MediumStructural Risk Force Deep Review
    LowScripts Present
    LowFilesystem
    LowObfuscated
    LowHigh Entropy Strings
    LowUrl Strings