registry / Remote code execution / burnboard-cli / 0.3.0

burnboard-cli@0.3.0

Connect local AI coding token usage to BurnBoard

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is not an automatic install-time attack, but the explicit command exposes a real unpinned remote-code and persistence capability controlled by a configurable endpoint. The host-data upload compounds that risk.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs burnboard setup or burnboard connect.

Impact

A selected server can supply code that runs repeatedly under the user account; hostname and platform are disclosed to that server.

Mechanism

Remote agent download, scheduled execution, and host metadata upload.

AI rationale

Evidence

cli.mjsinstall/burnboard-setup.sh$HOME/.burnboard/agent.mjs$HOME/.burnboard/config.json$HOME/.claude/settings.jsonuser crontab

Network endpoints1

burnboard-public.vercel.app

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The CLI accepts a caller-controlled server URL and invokes a setup script.
Setup downloads an unpinned agent script from that server, then schedules it to run every five minutes.
The connect command sends the machine hostname and platform to the selected server.
The installer removes Claude telemetry environment settings.

Evidence against

The manifest contains only a prepack script and no install lifecycle hook.
The risky setup path is reached through explicit CLI commands, not package import.

Behavioral surface

Source

ChildProcessFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 6.35 KB of source, external domains: burnboard-public.vercel.app

Source & flagged code

5 flagged

cli.mjsView file

Lines 1-49javascript

1#!/usr/bin/env node

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

6import { fileURLToPath } from "node:url";

8const packageRoot = path.dirname(fileURLToPath(import.meta.url));

9const installRoot = path.join(packageRoot, "install");

10const burnboardRoot = path.join(os.homedir(), ".burnboard");

11const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version;

12const installedVersionPath = path.join(burnboardRoot, "cli-version");

13const lastUpdateCheckPath = path.join(burnboardRoot, "last-update-check");

14const command = process.argv[2] || "help";

15const args = process.argv.slice(3);

17function option(name, fallback) {

18 const index = args.indexOf(name);

19 return index >= 0 ? args[index + 1] : fallback;

20}

22function run(executable, runArgs) {

23 const result = spawnSync(executable, runArgs, { stdio: "inherit" });

24 if (result.error) throw result.error;

25 process.exitCode = result.status ?? 1;

26 return result.status ?? 1;

27}

29function setup(nameOverride) {

30 const name = nameOverride || option("--name", args.find((value) => !value.startsWith("-")));

31 const server = option("--server", "https://burnboard-public.vercel.app");

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

cli.mjsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

32 if (!name || name.startsWith("--")) throw new Error('A name is required. Example: npx burnboard-cli setup --name "Harsh Sawant"');

33 let status;

34 if (process.platform === "win32") {

35 status = run("powershell.exe", ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", path.join(installRoot, "burnboard-setup.ps1"), "-Name", name, "-ServerUrl", server]);

36 } else {

37 status = run("bash", [path.join(installRoot, "burnboard-setup.sh"), name, server]);

Medium

Ai Review Evidence

The CLI accepts a caller-controlled server URL and invokes a setup script.

cli.mjsView on unpkg · L29

38 }

39 if (status === 0) {

40 fs.writeFileSync(installedVersionPath, `${cliVersion}\n`);

41 fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`);

42 }

43 return status;

44}

46async function connect() {

47 const code = option("--code", args.find((value) => !value.startsWith("-")));

48 const server = option("--server", "https://burnboard-public.vercel.app");

49 if (!code || code.startsWith("--")) throw new Error("A connection code is required. Copy the command shown on your BurnBoard profile.");

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli.mjs: const server = option("--server", "https://burnboard-public.vercel.app"); fs.writeFileSync(installedVersionPath, `${cliVersion}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`); const server = option("--server", "https://burnboard-public.vercel.app"); fs.writeFileSync(path.join(burnboardRoot, "config.json"), `${JSON.stringify({ serverUrl:server, token:body.token, profileUrl:body.profileUrl }, null, 2)}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli.mjsView on unpkg

install/burnboard-setup.shView file

•path = install/burnboard-setup.sh kind = build_helper sizeBytes = 3359 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-setup.shView on unpkg

Source & flagged code

5 flagged · loading source

cli.mjsView file

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url"; ... L9: const installRoot = path.join(packageRoot, "install"); L10: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L11: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L12: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L24: if (result.error) throw result.error; L25: process.exitCode = result.status ?? 1; L26: return result.status ?? 1; ... L30: const name = nameOverride || option("--name", args.find((value) => !value.startsWith("-"))); L31: const server = option("--server", "https://burnboard-public.vercel.app");

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

cli.mjsView on unpkg · L4

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

Findings

3 High4 Medium5 Low

HighHost Fingerprint Exfiltrationcli.mjs

HighEntrypoint Foreign Package Code Overwritecli.mjs

HighSandbox Evasion Gated Capabilitycli.mjs

MediumNetwork

MediumShips Build Helperinstall/burnboard-setup.sh

MediumStructural Risk Force Deep Review

MediumAi Review Evidencecli.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to burnboard-cli@0.3.0.

See all versions of burnboard-cli for other recorded verdicts.

Review the evidence and your use of burnboard-cli@0.3.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 23:39:03.082Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.