botmux@3.18.3: Suspicious npm security report (Warn)

Loading npm security reports…

botmux@3.18.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged

package.jsonView file

Lines 40-80json

40 "switch:here": "bun run build && bun run use:here",

41 "test": "vitest run --project unit",

42 "test:all": "vitest run",

43 "test:e2e": "vitest run --project e2e",

44 "test:bench": "tsx scripts/bench-tests.ts",

45 "test:codex": "vitest run --project e2e test/codex-input.e2e.ts",

46 "test:gemini": "vitest run --project e2e test/gemini-input.e2e.ts",

47 "test:agy": "vitest run --project e2e test/agy-input.e2e.ts",

48 "bench:resource": "node --expose-gc --import tsx scripts/bench-resource.ts",

49 "test:e2e-browser:setup": "tsx test/e2e-browser/setup-login.ts",

50 "test:e2e-browser": "tsx scripts/run-e2e.ts",

51 "report:dashboard": "tsx scripts/report-dashboard.ts",

52 "desktop:bundle": "node scripts/build-desktop-icons.mjs && esbuild src/desktop/main.ts --bundle --outfile=dist/desktop/main.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/preload.ts --bundle --outfile=dist/desktop/preload.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/renderer/app.ts --bundle --outfile=dist/desktop/renderer/app.js --platform=browser --format=iife && cp src/desktop/renderer/index.html dist/desktop/renderer/index.html && cp src/desktop/renderer/style.css dist/desktop/renderer/style.css && cp -R src/desktop/assets dist ...

53 "desktop:runtime": "node scripts/prepare-desktop-runtime.mjs",

54 "desktop:smoke": "tsx scripts/desktop-smoke.ts",

55 "desktop:install:local": "bash src/desktop/install-local.sh",

56 "desktop:dev": "bun run build && bun run desktop:bundle && electron dist/desktop/main.cjs",

57 "desktop:pack": "bun run desktop:pack:local",

58 "desktop:pack:local": "node scripts/desktop-pack-local.mjs",

59 "prepublishOnly": "npm run build",

60 "postinstall": "node scripts/postinstall-bin.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

61 "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

62 },

63 "dependencies": {

64 "@larksuiteoapi/node-sdk": "^1.64.0",

65 "@modelcontextprotocol/sdk": "^1.29.0",

66 "@xterm/addon-unicode11": "^0.9.0",

67 "@xterm/headless": "^6.0.0",

68 "croner": "^10.0.1",

69 "dotenv": "^17.3.1",

70 "markdown-it": "^14.1.1",

71 "pm2": "^6.0.0",

72 "proxy-agent": "^6.5.0",

73 "qrcode-terminal": "^0.12.0",

74 "react": "^19.2.7",

75 "react-dom": "^19.2.7",

76 "ws": "^8.19.0",

77 "yaml": "^2.9.0",

78 "zod": "^3.23.0"

79 },

80 "optionalDependencies": {

Long lines were clipped for display.

dist/codex-rpc-engine.jsView file

Lines 3-43javascript

3// Runs one `codex app-server --listen ws://127.0.0.1:<port>` per session (the

4// shared engine) and speaks JSON-RPC to it. The session's tmux pane runs the

5// real `codex --remote ws://... resume <threadId>` TUI, so rendering / web

6// terminal / idle detection are unchanged. User input is delivered via

7// `turn/start` (an acked RPC) instead of a tmux paste — bypassing the terminal

8// entirely, which is where codex drops bracketed pastes during its startup /

9// settings-churn terminal re-init (see codex-0144 investigation).

10//

11// Coordination (verified — raw-WS repro + real `codex --remote` TUI): the

dist/core/worker-pool.jsView file

79/** 在完整 Worker 模块加载前接住首条 IPC，避免冷启动耗时被误判为投递失败。 */ L80: function workerForkExecArgv() { L81: const preloadPath = join(__dirname, '..', 'worker-ipc-preload.js');

High

Shell

Package source references shell execution.

dist/core/worker-pool.jsView on unpkg · L79

dist/core/plugins/runtime.jsView file

Lines 70-110javascript

70 for (const id of selected) {

71 if (seen.has(id))

72 continue;

73 const record = registry.plugins[id];

dist/worker.jsView file

9* 3. Spawns CLI via CliAdapter + PtyBackend (interactive mode) L10: * 4. Starts HTTP + WebSocket server for xterm.js L11: * 5. Receives 'message' events from daemon, writes to PTY stdin ... L20: import { homedir, tmpdir, userInfo } from 'node:os'; L21: import { spawnSync } from 'node:child_process'; L22: import { [redacted], credentialIsolationRequired, [redacted], [redacted], buildCredentialIsolationRules... ... L176: // this one covers any worker spawn path that bypasses it). Scrubbing L177: // process.env — not just the spawned child's env — matters because worker-side L178: // resolvers consult it dynamically (codex submit confirmation / resume ... L723: headers: { 'content-type': 'application/json' }, L724: body: JSON.stringify({ L725: sessionId: cfg.sessionId,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/worker.jsView on unpkg · L9

dist/autostart.jsView file

Lines 1-36javascript

1/**

2 * Boot-time autostart integration for the botmux daemon.

3 *

4 * macOS — installs a LaunchAgent at ~/Library/LaunchAgents/com.botmux.daemon.plist

5 * and bootstraps it into the GUI domain (no sudo).

6 * Linux — installs a user systemd unit at ~/.config/systemd/user/botmux.service

7 * and enables it (no sudo). Reminds the user to run

8 * `loginctl enable-linger` if the unit needs to survive logout.

9 * Windows — installs a per-user Task Scheduler task, or falls back to the

10 * current user's Startup folder if task registration is denied.

dist/mira-runner.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { join } from

dist/setup/ensure-tmux.js#virtual:string-array:round1View file

17* threw on failure; that broke users whose tmux binary was present but L18: * couldn"t actually start a server (corrupt install / restricted /tmp /\n * broken ~/.tmux.conf — see daemon-error logs full of \"error connecting to\n * /tmp/tmux-UID/default\"), ... L19: * terminal tmux is gone (logged out, server killed, /tmp wiped) every ... L53: } L54: export function tmuxEnv(env = process.env) { L55: const rest = {}; ... L209: } L210: /** Suggest the manual command we"d have run, for the failure message. */\nexport function suggestManualCommand(pm, pkg) {\n switch (pm) {\n case "brew": return `brew ins... L211: // present-but-broken tmux as "genuinely absent".

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/setup/ensure-tmux.js#virtual:string-array:round1View on unpkg · L17

17Trigger-reachable chain: manifest.main -> dist/index-daemon.js -> dist/daemon.js -> dist/setup/ensure-tmux.js L17: * threw on failure; that broke users whose tmux binary was present but L18: * couldn"t actually start a server (corrupt install / restricted /tmp /\n * broken ~/.tmux.conf — see daemon-error logs full of \"error connecting to\n * /tmp/tmux-UID/default\"), ... L19: * terminal tmux is gone (logged out, server killed, /tmp wiped) every ... L53: } L54: export function tmuxEnv(env = process.env) { L55: const rest = {}; ... L209: } L210: /** Suggest the manual command we"d have run, for the failure message. */\nexport function suggestManualCommand(pm, pkg) {\n switch (pm) {\n case "brew": return `brew ins... L211: // present-but-broken tmux as "genuinely absent".

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/setup/ensure-tmux.js#virtual:string-array:round1

dist/features/codex-notifier/hook-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { accesssync, constants, existssync, mkdirsync, readfilesync } from 'node:fs'; import { homedir } from 'node:os'; import { dirname, join, win32 } from 'node:path'; import { atomicwritefilesync } from '../../utils/atomic-write.js'; function shellword(value) { if (/^[a-za-z0-9_./:@%+=,-]+$/.test(value)) return value; return `'${value.replaceall("'", `'"'"'`)}'`; } export function codexhookspath(env = process.env, userhome = homedir()) { const codexhome = typeof env.codex_home === 'string' && env.codex_home.trim() ? env.codex_home.trim() : join(userhome, '.codex'); return join(codexhome, 'hooks.json'); } export function botmuxcodexnoti

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/features/codex-notifier/hook-installer.jsView on unpkg

dist/services/skill-registry-store.js#virtual:normalized:round1View file

875// detached → own process group, so we can SIGKILL the WHOLE tree. The L876: // configured command is usually a shim (`npx agentbuddy@latest …`), so the L877: // real agentbuddy is a grandchild; killing only the direct child would L878: // leave it alive holding the pipes and polling the auth server. L879: child = spawn(bin, [...prefixArgs, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true }); L880: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/skill-registry-store.js#virtual:normalized:round1View on unpkg · L875

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 30

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bin.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/codex-rpc-engine.jsView file

23// what froze the Web terminal). See codex-rpc-lifecycle + worker engageCodexRpc. L24: import { spawn, execFileSync } from 'node:child_process'; L25: import { createServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/codex-rpc-engine.jsView on unpkg · L23

dist/core/worker-pool.jsView file

High

Shell

Package source references shell execution.

dist/core/worker-pool.jsView on unpkg · L79

dist/core/plugins/runtime.jsView file

90throw new Error(`plugin_service_entry_not_found:${record.id}:${entrypoint}`); L91: const mod = await import(pathToFileURL(entry).href); L92: const exported = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/plugins/runtime.jsView on unpkg · L90

dist/worker.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/worker.jsView on unpkg · L9

dist/autostart.jsView file

16*/ L17: import { spawnSync } from 'node:child_process'; L18: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from 'node:fs'; ... L24: function platform() { L25: if (process.platform === 'darwin') L26: return 'macos'; ... L36: function plistPath() { L37: return join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); L38: } ... L56: // tmux, etc.). Falls back to a sane default if PATH is empty. L57: const p = process.env.PATH || ''; L58: if (p)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L16

dist/mira-runner.jsView file

1#!/usr/bin/env node L2: import { execFileSync } from 'node:child_process'; L3: import { existsSync } from 'node:fs'; ... L8: import { RunnerControlWriter } from './adapters/cli/runner-control-channel.js'; L9: const MIRA_DOMAIN = 'https://mira.bytedance.com'; L10: const API_BASE_URL = process.env.MIRA_API_BASE_URL ?? `${MIRA_DOMAIN}/mira/api/v1`; L11: const MODEL_METADATA_URL = process.env.MIRA_MODEL_METADATA_URL ?? `${MIRA_DOMAIN}/api/v1/model/metadata`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mira-runner.jsView on unpkg · L1

dist/setup/ensure-tmux.js#virtual:string-array:round1View file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/setup/ensure-tmux.js#virtual:string-array:round1View on unpkg · L17

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/setup/ensure-tmux.js#virtual:string-array:round1

dist/features/codex-notifier/hook-installer.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/features/codex-notifier/hook-installer.jsView on unpkg

dist/services/skill-registry-store.js#virtual:normalized:round1View file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/skill-registry-store.js#virtual:normalized:round1View on unpkg · L875

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 30

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 40-80json

40 "switch:here": "bun run build && bun run use:here",

41 "test": "vitest run --project unit",

42 "test:all": "vitest run",

43 "test:e2e": "vitest run --project e2e",

44 "test:bench": "tsx scripts/bench-tests.ts",

45 "test:codex": "vitest run --project e2e test/codex-input.e2e.ts",

46 "test:gemini": "vitest run --project e2e test/gemini-input.e2e.ts",

47 "test:agy": "vitest run --project e2e test/agy-input.e2e.ts",

48 "bench:resource": "node --expose-gc --import tsx scripts/bench-resource.ts",

49 "test:e2e-browser:setup": "tsx test/e2e-browser/setup-login.ts",

50 "test:e2e-browser": "tsx scripts/run-e2e.ts",

51 "report:dashboard": "tsx scripts/report-dashboard.ts",

53 "desktop:runtime": "node scripts/prepare-desktop-runtime.mjs",

54 "desktop:smoke": "tsx scripts/desktop-smoke.ts",

55 "desktop:install:local": "bash src/desktop/install-local.sh",

56 "desktop:dev": "bun run build && bun run desktop:bundle && electron dist/desktop/main.cjs",

57 "desktop:pack": "bun run desktop:pack:local",

58 "desktop:pack:local": "node scripts/desktop-pack-local.mjs",

59 "prepublishOnly": "npm run build",

60 "postinstall": "node scripts/postinstall-bin.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

61 "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

62 },

63 "dependencies": {

64 "@larksuiteoapi/node-sdk": "^1.64.0",

65 "@modelcontextprotocol/sdk": "^1.29.0",

66 "@xterm/addon-unicode11": "^0.9.0",

67 "@xterm/headless": "^6.0.0",

68 "croner": "^10.0.1",

69 "dotenv": "^17.3.1",

70 "markdown-it": "^14.1.1",

71 "pm2": "^6.0.0",

72 "proxy-agent": "^6.5.0",

73 "qrcode-terminal": "^0.12.0",

74 "react": "^19.2.7",

75 "react-dom": "^19.2.7",

76 "ws": "^8.19.0",

77 "yaml": "^2.9.0",

78 "zod": "^3.23.0"

79 },

80 "optionalDependencies": {

Long lines were clipped for display.

dist/codex-rpc-engine.jsView file

Lines 3-43javascript

3// Runs one `codex app-server --listen ws://127.0.0.1:<port>` per session (the

4// shared engine) and speaks JSON-RPC to it. The session's tmux pane runs the

5// real `codex --remote ws://... resume <threadId>` TUI, so rendering / web

6// terminal / idle detection are unchanged. User input is delivered via

7// `turn/start` (an acked RPC) instead of a tmux paste — bypassing the terminal

8// entirely, which is where codex drops bracketed pastes during its startup /

9// settings-churn terminal re-init (see codex-0144 investigation).

10//

11// Coordination (verified — raw-WS repro + real `codex --remote` TUI): the

dist/core/worker-pool.jsView file

High

Shell

Package source references shell execution.

dist/core/worker-pool.jsView on unpkg · L79

dist/core/plugins/runtime.jsView file

Lines 70-110javascript

70 for (const id of selected) {

71 if (seen.has(id))

72 continue;

73 const record = registry.plugins[id];

dist/worker.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/worker.jsView on unpkg · L9

dist/autostart.jsView file

Lines 1-36javascript

1/**

2 * Boot-time autostart integration for the botmux daemon.

3 *

4 * macOS — installs a LaunchAgent at ~/Library/LaunchAgents/com.botmux.daemon.plist

5 * and bootstraps it into the GUI domain (no sudo).

6 * Linux — installs a user systemd unit at ~/.config/systemd/user/botmux.service

7 * and enables it (no sudo). Reminds the user to run

8 * `loginctl enable-linger` if the unit needs to survive logout.

9 * Windows — installs a per-user Task Scheduler task, or falls back to the

10 * current user's Startup folder if task registration is denied.

dist/mira-runner.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync } from 'node:child_process';

3import { existsSync } from 'node:fs';

4import { homedir } from 'node:os';

5import { join } from

dist/setup/ensure-tmux.js#virtual:string-array:round1View file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/setup/ensure-tmux.js#virtual:string-array:round1View on unpkg · L17

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/setup/ensure-tmux.js#virtual:string-array:round1

dist/features/codex-notifier/hook-installer.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/features/codex-notifier/hook-installer.jsView on unpkg

dist/services/skill-registry-store.js#virtual:normalized:round1View file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/skill-registry-store.js#virtual:normalized:round1View on unpkg · L875

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 30

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View on unpkg

botmux@3.18.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code