registry / AI-agent capability abuse / burnboard-cli / 0.4.5

burnboard-cli@0.4.5

Connect local AI coding token usage to BurnBoard

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has a real privacy and persistence risk because an explicit command installs continuous cross-tool data collection, uploads it, and mutates Claude settings. No automatic npm lifecycle trigger or confirmed secret or conversation-content theft was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user runs a BurnBoard join, connect, setup, or update command.

Impact

Local AI-tool metadata is continuously sent to the configured BurnBoard server, and the user's Claude settings and background scheduler are modified.

Mechanism

Persistent collection and upload of local AI-tool usage metadata.

AI rationale

Evidence

install/burnboard-agent.mjsinstall/burnboard-setup.sh$HOME/.burnboard/agent.mjs$HOME/.burnboard/config.json$HOME/.claude/settings.json$HOME/.config/systemd/user/burnboard-sync.service$HOME/.config/systemd/user/burnboard-sync.timer$HOME/.config/systemd/user/burnboard-update.service$HOME/.config/systemd/user/burnboard-update.timer

Network endpoints2

burnboard.cc127.0.0.1

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The CLI reads local Claude, Cursor, OpenCode, Codex, and Antigravity usage records and sends aggregated usage to the configured server.
It extracts an Antigravity CSRF token from local logs and uses it to query a loopback conversation service.
Explicit setup installs a recurring background sync and an automatic update command that fetches the latest package release.
Setup removes telemetry-related settings from the user's Claude configuration.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
The risky setup path is reached from explicit CLI connection or setup actions, not package installation.
The submitted records are usage buckets; the inspected upload code does not transmit conversation text.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

Source & flagged code

7 flagged

install/burnboard-agent.mjsView file

Lines 1-70javascript

1import fs from "node:fs";

2import os from "node:os";

3import path from "node:path";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

install/burnboard-agent.mjsView on unpkg · L3

6let DatabaseSync;

7try { if (!process.env.BURNBOARD_FORCE_SQLITE_FALLBACK) ({ DatabaseSync } = await import("node:sqlite")); } catch {}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

install/burnboard-agent.mjsView on unpkg · L6

9let BetterSqlite3;

10async function openSqlite(file) {

11 if (DatabaseSync) {

12 const database = new DatabaseSync(file, { readOnly: true });

13 return { all: (sql) => database.prepare(sql).all(), close: () => database.close() };

14 }

15 BetterSqlite3 ||= (await import(new URL("./sqlite/lib/index.js", import.meta.url))).default;

16 const nativeBinding = path.join(path.dirname(fileURLToPath(import.meta.url)), "sqlite", "better_sqlite3.node");

17 const database = new BetterSqlite3(file, { readonly: true, fileMustExist: true, nativeBinding });

18 return { all: (sql) => database.prepare(sql).all(), close: () => database.close() };

19}

21const home = os.homedir();

22const root = path.join(home, ".burnboard");

23const dryRun = process.argv.includes("--dry-run");

24const jsonOutput = process.argv.includes("--json");

25const onlyTool = process.argv.find((argument) => argument.startsWith("--only="))?.slice(7);

26const config = dryRun ? null : JSON.parse(fs.readFileSync(path.join(root, "config.json"), "utf8").replace(/^\uFEFF/, ""));

30 title = String(title || "BurnBoard").slice(0, 100);

31 message = String(message || "").slice(0, 200);

32 if (!message) return;

33 let notificationUrl;

34 try {

35 const candidate = new URL(destination);

36 if (candidate.protocol === "https:" || (candidate.protocol === "http:" && ["localhost","127.0.0.1"].includes(candidate.hostname))) notificationUrl = candidate.origin;

37 } catch {}

38 if (!notificationUrl) return;

39 if (process.platform === "win32") {

40 const script = `

41[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null

42[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] > $null

43$title = [Security.SecurityElement]::Escape($env:BURNBOARD_NOTIFICATION_TITLE)

44$message = [Security.SecurityElement]::Escape($env:BURNBOARD_NOTIFICATION_MESSAGE)

45$url = [Security.SecurityElement]::Escape($env:BURNBOARD_NOTIFICATION_URL)

46$xml = New-Object Windows.Data.Xml.Dom.XmlDocument

47$xml.LoadXml("<toast activationType='protocol' launch='$url'><visual><binding template='ToastGeneric'><text>$title</text><text>$message</text></binding></visual></toast>")

48$toast = New-Object Windows.UI.Notifications.ToastNotification $xml

49[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('BurnBoard.Desktop').Show($toast)

50`;

51 spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], {

52 stdio:"ignore", env:{ ...process.env, BURNBOARD_NOTIFICATION_TITLE:title, BURNBOARD_NOTIFICATION_MESSAGE:message, BURNBOARD_NOTIFICATION_URL:notificationUrl },

High

Shell

Package source references shell execution.

install/burnboard-agent.mjsView on unpkg · L50

53 });

54 } else if (process.platform === "darwin") {

55 spawnSync("osascript", ["-e", "display notification (system attribute \"BURNBOARD_NOTIFICATION_MESSAGE\") with title (system attribute \"BURNBOARD_NOTIFICATION_TITLE\")"], {

56 stdio:"ignore", env:{ ...process.env, BURNBOARD_NOTIFICATION_TITLE:title, BURNBOARD_NOTIFICATION_MESSAGE:message },

57 });

58 } else {

59 spawnSync("notify-send", [title, message], { stdio:"ignore" });

60 }

61}

63function localDate(value) {

64 const parts = new Intl.DateTimeFormat("en-CA", { timeZone: "Asia/Kolkata", year: "numeric", month: "2-digit", day: "2-digit" }).formatToParts(new Date(value));

65 const get = (type) => parts.find((part) => part.type === type)?.value;

66 return `${get("year")}-${get("month")}-${get("day")}`;

67}

69function addUsage({ recordedAt, tool, model, input = 0, output = 0, cacheRead = 0, cacheCreation = 0 }) {

70 const values = [input, output, cacheRead, cacheCreation].map(Number);

cli.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawn, spawnSync } from "node:child_process"

install/burnboard-register-notifications.ps1View file

•path = install/burnboard-register-notifications.ps1 kind = build_helper sizeBytes = 4418 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-register-notifications.ps1View on unpkg

Source & flagged code

7 flagged · loading source

install/burnboard-agent.mjsView file

3import path from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

install/burnboard-agent.mjsView on unpkg · L3

50`; L51: spawnSync("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], { L52: stdio:"ignore", env:{ ...process.env, BURNBOARD_NOTIFICATION_TITLE:title, BURNBOARD_NOTIFICATION_MESSAGE:message, BURNBOARD_NOTIFICATION_URL:notificationUrl },

High

Shell

Package source references shell execution.

install/burnboard-agent.mjsView on unpkg · L50

6let DatabaseSync; L7: try { if (!process.env.BURNBOARD_FORCE_SQLITE_FALLBACK) ({ DatabaseSync } = await import("node:sqlite")); } catch {} L8:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

install/burnboard-agent.mjsView on unpkg · L6

Findings

1 Critical4 High5 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationcli.mjs

HighChild Processinstall/burnboard-agent.mjs

HighShellinstall/burnboard-agent.mjs

HighSame File Env Network Executioncli.mjs

HighSandbox Evasion Gated Capabilitycli.mjs

MediumDynamic Requireinstall/burnboard-agent.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall/burnboard-register-notifications.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to burnboard-cli@0.4.5.

See all versions of burnboard-cli for other recorded verdicts.

Review the evidence and your use of burnboard-cli@0.4.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 16:04:27.106Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.