Loading npm security reports…

botmux@3.18.6: Malicious npm security report (Block) | LPM Firewall

registry / botmux / 3.18.6

botmux@3.18.6

Bridge between IM platforms and AI coding CLIs — one topic, one CLI session with live streaming

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Creating a Riff task automatically sends a global npm installation of botmux to a remote sandbox. The installed release runs postinstall, which installs an executable launcher and changes shell startup configuration.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A Riff-backed botmux task is created.

Impact

A remote sandbox receives an unpinned later release of the package, which can alter the sandbox user's command resolution and shell startup behavior without a separate installation action.

Mechanism

Automatic self-installation followed by lifecycle-based launcher and PATH persistence.

Attack narrative

When a Riff task is created, the package submits a mandatory setup command that runs `npm install -g botmux` with output suppressed and follows the latest tag. That nested installation runs this package's postinstall hook. The hook writes an executable launcher under the user's home directory and invokes a helper that changes shell startup files to put it on PATH. This is an automatic lifecycle self-dependency chain with persistent environment mutation.

AI rationale

The source establishes an automatic, unpinned self-install chain into a remote sandbox and a lifecycle hook that persistently changes command execution and shell configuration. This matches malicious install-hook abuse under the stated lifecycle self-dependency policy.

Evidence

dist/adapters/backend/riff-backend.jspackage.jsonscripts/postinstall-bin.mjsscripts/install-path-entry.mjs~/.botmux/bin/botmux~/.zshenv~/.bashrc

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bin.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/codex-rpc-engine.jsView file

23// what froze the Web terminal). See codex-rpc-lifecycle + worker engageCodexRpc. L24: import { spawn, execFileSync } from 'node:child_process'; L25: import { createServer } from 'node:net';

High

Child Process

Package source references child process execution.

dist/codex-rpc-engine.jsView on unpkg · L23

dist/core/worker-pool.jsView file

79/** 在完整 Worker 模块加载前接住首条 IPC，避免冷启动耗时被误判为投递失败。 */ L80: function workerForkExecArgv() { L81: const preloadPath = join(__dirname, '..', 'worker-ipc-preload.js');

High

Shell

Package source references shell execution.

dist/core/worker-pool.jsView on unpkg · L79

dist/core/plugins/runtime.jsView file

90throw new Error(`plugin_service_entry_not_found:${record.id}:${entrypoint}`); L91: const mod = await import(pathToFileURL(entry).href); L92: const exported = mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/plugins/runtime.jsView on unpkg · L90

dist/worker.jsView file

9* 3. Spawns CLI via CliAdapter + PtyBackend (interactive mode) L10: * 4. Starts HTTP + WebSocket server for xterm.js L11: * 5. Receives 'message' events from daemon, writes to PTY stdin ... L20: import { homedir, tmpdir, userInfo } from 'node:os'; L21: import { spawnSync } from 'node:child_process'; L22: import { [redacted], credentialIsolationRequired, [redacted], [redacted], buildCredentialIsolationRules... ... L176: // this one covers any worker spawn path that bypasses it). Scrubbing L177: // process.env — not just the spawned child's env — matters because worker-side L178: // resolvers consult it dynamically (codex submit confirmation / resume ... L723: headers: { 'content-type': 'application/json' }, L724: body: JSON.stringify({ L725: sessionId: cfg.sessionId,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/worker.jsView on unpkg · L9

dist/autostart.jsView file

16*/ L17: import { spawnSync } from 'node:child_process'; L18: import { existsSync, mkdirSync, writeFileSync, unlinkSync, readFileSync } from 'node:fs'; ... L24: function platform() { L25: if (process.platform === 'darwin') L26: return 'macos'; ... L36: function plistPath() { L37: return join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); L38: } ... L56: // tmux, etc.). Falls back to a sane default if PATH is empty. L57: const p = process.env.PATH || ''; L58: if (p)

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart.jsView on unpkg · L16

dist/mira-runner.jsView file

1#!/usr/bin/env node L2: import { execFileSync } from 'node:child_process'; L3: import { existsSync } from 'node:fs'; ... L8: import { RunnerControlWriter } from './adapters/cli/runner-control-channel.js'; L9: const MIRA_DOMAIN = 'https://mira.bytedance.com'; L10: const API_BASE_URL = process.env.MIRA_API_BASE_URL ?? `${MIRA_DOMAIN}/mira/api/v1`; L11: const MODEL_METADATA_URL = process.env.MIRA_MODEL_METADATA_URL ?? `${MIRA_DOMAIN}/api/v1/model/metadata`;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mira-runner.jsView on unpkg · L1

dist/setup/ensure-tmux.js#virtual:string-array:round1View file

17* threw on failure; that broke users whose tmux binary was present but L18: * couldn"t actually start a server (corrupt install / restricted /tmp /\n * broken ~/.tmux.conf — see daemon-error logs full of \"error connecting to\n * /tmp/tmux-UID/default\"), ... L19: * terminal tmux is gone (logged out, server killed, /tmp wiped) every ... L53: } L54: export function tmuxEnv(env = process.env) { L55: const rest = {}; ... L209: } L210: /** Suggest the manual command we"d have run, for the failure message. */\nexport function suggestManualCommand(pm, pkg) {\n switch (pm) {\n case "brew": return `brew ins... L211: // present-but-broken tmux as "genuinely absent".

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/setup/ensure-tmux.js#virtual:string-array:round1View on unpkg · L17

17Trigger-reachable chain: manifest.main -> dist/index-daemon.js -> dist/daemon.js -> dist/setup/ensure-tmux.js L17: * threw on failure; that broke users whose tmux binary was present but L18: * couldn"t actually start a server (corrupt install / restricted /tmp /\n * broken ~/.tmux.conf — see daemon-error logs full of \"error connecting to\n * /tmp/tmux-UID/default\"), ... L19: * terminal tmux is gone (logged out, server killed, /tmp wiped) every ... L53: } L54: export function tmuxEnv(env = process.env) { L55: const rest = {}; ... L209: } L210: /** Suggest the manual command we"d have run, for the failure message. */\nexport function suggestManualCommand(pm, pkg) {\n switch (pm) {\n case "brew": return `brew ins... L211: // present-but-broken tmux as "genuinely absent".

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/setup/ensure-tmux.js#virtual:string-array:round1

dist/features/codex-notifier/hook-installer.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { accesssync, constants, existssync, mkdirsync, readfilesync } from 'node:fs'; import { homedir } from 'node:os'; import { dirname, join, win32 } from 'node:path'; import { atomicwritefilesync } from '../../utils/atomic-write.js'; function shellword(value) { if (/^[a-za-z0-9_./:@%+=,-]+$/.test(value)) return value; return `'${value.replaceall("'", `'"'"'`)}'`; } export function codexhookspath(env = process.env, userhome = homedir()) { const codexhome = typeof env.codex_home === 'string' && env.codex_home.trim() ? env.codex_home.trim() : join(userhome, '.codex'); return join(codexhome, 'hooks.json'); } export function botmuxcodexnoti

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/features/codex-notifier/hook-installer.jsView on unpkg

dist/services/skill-registry-store.js#virtual:normalized:round1View file

875// detached → own process group, so we can SIGKILL the WHOLE tree. The L876: // configured command is usually a shim (`npx agentbuddy@latest …`), so the L877: // real agentbuddy is a grandchild; killing only the direct child would L878: // leave it alive holding the pipes and polling the auth server. L879: child = spawn(bin, [...prefixArgs, ...args], { cwd, stdio: ["ignore", "pipe", "pipe"], detached: true }); L880: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/services/skill-registry-store.js#virtual:normalized:round1View on unpkg · L875

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 33

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/backend/mojo-types.js#virtual:normalized:round1View on unpkg

dist/adapters/backend/riff-backend.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = botmux@3.22.0 matchedIdentity = npm:Ym90bXV4:3.22.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/adapters/backend/riff-backend.jsView on unpkg