registry / Remote code execution / burnboard-cli / 0.4.2

burnboard-cli@0.4.2

Connect local AI coding token usage to BurnBoard

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is not an install-hook attack, but it provides an opaque remote tracker with persistence and modifies a foreign AI-tool configuration. The behavior is sufficiently risky and unresolved to warn rather than publish-block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user runs the connect, join, or setup CLI command.

Impact

A service-controlled agent can repeatedly run and handle local AI-tool history after setup.

Mechanism

Remote JavaScript loading, AI-tool configuration mutation, and recurring task persistence.

AI rationale

Evidence

cli.mjsinstall/burnboard-setup.sh~/.burnboard/agent.mjs~/.burnboard/config.json~/.claude/settings.jsoncrontab~/.config/systemd/user/burnboard-sync.service~/.config/systemd/user/burnboard-update.service

Network endpoints1

burnboard.cc

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit connect and join flows install a tracker after authentication.
The installer downloads an unpinned JavaScript agent from the service and runs it.
The installer removes Claude telemetry settings and creates recurring sync and update jobs.
Recurring updates invoke the latest release of this package without user interaction.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The risky setup path is reached through an explicit CLI connection or setup command.
The downloaded agent is not included in this snapshot, so its collection behavior cannot be verified directly.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 16.3 KB of source, external domains: burnboard.cc

Source & flagged code

6 flagged

cli.mjsView file

4Source sends the broad process environment to a literal external destination. L4: import path from "node:path"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { randomUUID } from "node:crypto"; ... L12: const installRoot = path.join(packageRoot, "install"); L13: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L14: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L15: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L21: const args = process.argv.slice(optionOnly ? 2 : 3); L22: const richTerminal = Boolean(process.stdout.isTTY && process.stdin.isTTY); L23: const brandColorEnabled = richTerminal && !process.env.NO_COLOR && process.env.TERM !== "dumb"; L24: const brandColor = (r

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

cli.mjsView on unpkg · L4

4import path from "node:path"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

cli.mjsView on unpkg · L4

109if (process.platform === "win32") { L110: status = run("powershell.exe", ["-NoLogo", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", path.join(installRoot, "burnboard-setup.ps1"), "-Name", name, "-ServerUrl", server],... L111: } else {

High

Shell

Package source references shell execution.

cli.mjsView on unpkg · L109

95fs.writeFileSync(path.join(burnboardRoot, "config.json"), `${JSON.stringify({ serverUrl:server, token:enrollment.token, profileUrl:enrollment.profileUrl }, null, 2)}\n`); L96: if (process.env.BURNBOARD_CLI_TEST_MODE === "1") return; L97: if (setup("Connected BurnBoard User", "connect", server) !== 0) throw new Error("Connected, but the local tracker could not be installed. Run `npx --yes burnboard-cli@latest update... ... L105: if (fs.existsSync(existingConfigPath)) try { savedServer = JSON.parse(fs.readFileSync(existingConfigPath, "utf8").replace(/^\uFEFF/, "")).serverUrl; } catch {} L106: const server = requestedServer || serverOverride || (mode !== "connect" ? savedServer : undefined) || "https://burnboard.cc"; L107: if (!name || name.startsWith("--")) throw new Error('A name is re

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.mjsView on unpkg · L95

4import path from "node:path"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { randomUUID } from "node:crypto"; ... L12: const installRoot = path.join(packageRoot, "install"); L13: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L14: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L15: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L21: const args = process.argv.slice(optionOnly ? 2 : 3); L22: const richTerminal = Boolean(process.stdout.isTTY && process.stdin.isTTY); L23: const brandColorEnabled = richTerminal && !process.env.NO_COLOR && process.env.TERM !== "dumb"; L24: const brandColor = (red, green, blue) => (value) => brandColorEnabled ... L74: if (process.env.BURN

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

install/burnboard-setup.shView file

•path = install/burnboard-setup.sh kind = build_helper sizeBytes = 7609 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-setup.shView on unpkg

Source & flagged code

6 flagged · loading source

cli.mjsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

cli.mjsView on unpkg · L4

4import path from "node:path"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

cli.mjsView on unpkg · L4

Findings

1 Critical4 High4 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationcli.mjs

HighChild Processcli.mjs

HighShellcli.mjs

HighSame File Env Network Executioncli.mjs

HighSandbox Evasion Gated Capabilitycli.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall/burnboard-setup.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to burnboard-cli@0.4.2.

See all versions of burnboard-cli for other recorded verdicts.

Review the evidence and your use of burnboard-cli@0.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 17:52:40.070Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.