registry / botmux / 3.19.3

botmux@3.19.3

Bridge between IM platforms and AI coding CLIs — one topic, one CLI session with live streaming

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A global installation runs a platform binary and changes the user's launcher and shell PATH configuration. No credential theft or network activity was found in the inspected lifecycle source.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing botmux globally through a package manager.

Impact

The package can persist its command on future shell sessions and executes its own binary at install time.

Mechanism

Postinstall binary probe plus launcher and shell-startup-file modification.

AI rationale

The lifecycle script performs persistent shell configuration and executes a bundled binary automatically on global install. Its scope is limited to the package's own launcher, so this warrants a warning rather than a block.

Evidence

scripts/postinstall-bin.mjsscripts/install-path-entry.mjs~/.botmux/bin/botmux~/.zshenv~/.bashrc~/.bash_profile~/.bash_login~/.profile~/.config/fish/conf.d/botmux.fish

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package runs a postinstall script automatically.
On a global install, the script executes a bundled platform binary during installation.
The postinstall creates a launcher in the user's home directory and then updates shell startup files to add it to PATH.

Evidence against

The postinstall exits for ordinary non-global installations.
It only resolves the matching botmux platform subpackage; no self-dependency is declared.
The inspected scripts contain no credential collection, network request, or remote payload download.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 33.7 KB of source, external domains: raw.githubusercontent.com

Source & flagged code

5 flagged

package.jsonView file

Lines 41-82json

41 "test": "vitest run --project unit",

42 "test:all": "vitest run",

43 "test:e2e": "vitest run --project e2e",

44 "test:bun": "node scripts/run-bun-tests.mjs",

45 "test:bun:self-check": "node scripts/run-bun-tests.mjs --self-check",

46 "test:bench": "tsx scripts/bench-tests.ts",

47 "test:codex": "vitest run --project e2e test/codex-input.e2e.ts",

48 "test:gemini": "vitest run --project e2e test/gemini-input.e2e.ts",

49 "test:agy": "vitest run --project e2e test/agy-input.e2e.ts",

50 "bench:resource": "node --expose-gc --import tsx scripts/bench-resource.ts",

51 "test:e2e-browser:setup": "tsx test/e2e-browser/setup-login.ts",

52 "test:e2e-browser": "tsx scripts/run-e2e.ts",

53 "report:dashboard": "tsx scripts/report-dashboard.ts",

54 "desktop:bundle": "node scripts/build-desktop-icons.mjs && esbuild src/desktop/main.ts --bundle --outfile=dist/desktop/main.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/preload.ts --bundle --outfile=dist/desktop/preload.cjs --platform=node --format=cjs --external:electron && esbuild src/desktop/renderer/app.ts --bundle --outfile=dist/desktop/renderer/app.js --platform=browser --format=iife && cp src/desktop/renderer/index.html dist/desktop/renderer/index.html && cp src/desktop/renderer/style.css dist/desktop/renderer/style.css && cp -R src/desktop/assets dist ...

55 "desktop:runtime": "node scripts/prepare-desktop-runtime.mjs",

56 "desktop:smoke": "tsx scripts/desktop-smoke.ts",

57 "desktop:install:local": "bash src/desktop/install-local.sh",

58 "desktop:dev": "bun run build && bun run desktop:bundle && electron dist/desktop/main.cjs",

59 "desktop:pack": "bun run desktop:pack:local",

60 "desktop:pack:local": "node scripts/desktop-pack-local.mjs",

61 "prepublishOnly": "npm run build",

62 "postinstall": "node scripts/postinstall-bin.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

63 "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L61

64 },

65 "dependencies": {

66 "@larksuiteoapi/node-sdk": "^1.64.0",

67 "@modelcontextprotocol/sdk": "^1.29.0",

68 "@xterm/addon-unicode11": "^0.9.0",

69 "@xterm/headless": "^6.0.0",

70 "croner": "^10.0.1",

71 "dotenv": "^17.3.1",

72 "markdown-it": "^14.1.1",

73 "pm2": "^6.0.0",

74 "proxy-agent": "^6.5.0",

75 "qrcode-terminal": "^0.12.0",

76 "react": "^19.2.7",

77 "react-dom": "^19.2.7",

78 "ws": "^8.19.0",

79 "yaml": "^2.9.0",

80 "zod": "^3.23.0"

81 },

82 "optionalDependencies": {

Long lines were clipped for display.

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-bin.mjsView file

Lines 245-307javascript

245}

246

247// The binary must be executable or the launcher's `exec` fails at RUN time — long

248// after install, with a confusing error. npm preserves the exec bit from the

249// tarball, but a repacked/mirrored registry may not, so repair it here rather than

250// trusting it.

251try {

252 const mode = statSync(binary).mode;

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bin.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

61"prepublishOnly": "npm run build", "postinstall": "node scripts/postinstall-bin.mjs", "prepare": "git config core.hooksPath scripts/git-hooks 2>/dev/null || true"

Medium

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L61

scripts/install-path-entry.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/install-path-entry.mjs#virtual:normalized:round1View on unpkg

scripts/postinstall-bin.mjsView file

265const probe = spawnSync(binary, ['--version'], { encoding: 'utf-8', timeout: 30_000, env: { ...process.env, BOTMUX_INSTALL_PROBE: '1' }, });

Medium

Ai Review Evidence

On a global install, the script executes a bundled platform binary during installation.

scripts/postinstall-bin.mjsView on unpkg · L265

287const binDir = join(homedir(), '.botmux', 'bin'); const launcher = join(binDir, 'botmux'); // `exec` replaces the shell process, so signals/exit codes pass straight through // to the binary. No `node` anywhere in this launcher — that is the entire point. const content = `#!/bin/sh\nexec "${binary}" "$@"\n`;

Medium

Suspicious Lifecycle Evidence

The postinstall creates a launcher in the user's home directory and then updates shell startup files to add it to PATH.

scripts/postinstall-bin.mjsView on unpkg · L287

Findings

2 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSemantic Analysis Limitedscripts/install-path-entry.mjs#virtual:normalized:round1

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSuspicious Lifecycle Evidencepackage.json

MediumAi Review Evidencescripts/postinstall-bin.mjs

MediumSuspicious Lifecycle Evidencescripts/postinstall-bin.mjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to botmux@3.19.3.

See version security history for other recorded verdicts.

Review the evidence and your use of botmux@3.19.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-07 15:54:40.810Z (UTC).