AI Security Review
scanned 2h ago · by lpm-firewall-aiLPM treats this as warn-only first-party agent extension lifecycle risk. `postinstall` creates managed ChainlessChain CLI skill packs under its own desktop-app user-data directory. This is an install-time AI-agent extension setup, but no exfiltration, remote code retrieval, or foreign agent configuration mutation was confirmed.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation triggers `postinstall`.
Impact
Adds globally available ChainlessChain-managed agent skills without an explicit user command.
Mechanism
Generates package-defined skill metadata and handlers into first-party app storage.
Rationale
This is a real install-time first-party agent-extension setup and merits a warning under the stated policy, but inspected source does not establish malicious behavior. The scanner's malicious label is not supported by the lifecycle source.
Evidence
package.jsonscripts/postinstall.mjssrc/lib/skill-packs/generator.jssrc/lib/paths.jssrc/commands/update.jssrc/auth/npm-auth.js
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json runs `node scripts/postinstall.mjs` at install.
- scripts/postinstall.mjs imports and invokes `generateCliPacks` automatically.
- src/lib/skill-packs/generator.js writes generated `SKILL.md` and `handler.js` files.
- src/lib/paths.js targets the package-owned `chainlesschain-desktop-vue` user-data directory.
Evidence against
- Postinstall uses no network API or credential harvesting.
- Generated packs are derived from bundled schema/source, not remote payloads.
- No foreign `.claude`, `.codex`, or `.cursor` control-surface write was found in inspected lifecycle path.
- Runtime shell/npm actions in `src/commands/update.js` and `src/auth/npm-auth.js` are explicit CLI commands.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings
Source & flagged code
12 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/auth/npm-auth.jsView file
6L7: import { execSync } from "child_process";
L8: import { logger } from "../lib/logger.js";
High
Child Process
Package source references child process execution.
src/auth/npm-auth.jsView on unpkg · L6src/runtime/agent-core.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = chainlesschain@0.162.159
matchedIdentity = npm:Y2hhaW5sZXNzY2hhaW4:0.162.159
similarity = 0.867
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
src/runtime/agent-core.jsView on unpkg1264// Sensitive-file write guard (Claude-Code 2.1.160 parity): shell startup
L1265: // files / PowerShell profiles / git+husky hooks execute code on the user's
L1266: // next shell or commit — even otherwise-permitted edit flows confirm first.
High
src/lib/plugin-ecosystem.jsView file
86severity: REVIEW_SEVERITY.BLOCKER,
L87: message: "Use of eval() — code injection risk",
L88: penalty: 40,
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/lib/plugin-ecosystem.jsView on unpkg · L86scripts/postinstall.mjsView file
6try {
L7: const { generateCliPacks } = await import(
L8: "../src/lib/skill-packs/generator.js"
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/postinstall.mjsView on unpkg · L6src/harness/prompt-compressor.jsView file
680archivedAt: null,
L681: metadata: { ...(metadata || {}) },
L682: };
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/harness/prompt-compressor.jsView on unpkg · L680src/lib/mcp-oauth.jsView file
30export const _deps = {
L31: fetch: (...a) => globalThis.fetch(...a),
L32: fs: fsDefault,
...
L37: openBrowser: defaultOpenBrowser,
L38: spawn: (...a) => spawn(...a),
L39: now: () => Date.now(),
...
L43: warn: (msg) => {
L44: if (!process.env.VITEST) process.stderr.write(msg);
L45: },
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
src/lib/mcp-oauth.jsView on unpkg · L3030export const _deps = {
L31: fetch: (...a) => globalThis.fetch(...a),
L32: fs: fsDefault,
...
L37: openBrowser: defaultOpenBrowser,
L38: spawn: (...a) => spawn(...a),
L39: now: () => Date.now(),
...
L43: warn: (msg) => {
L44: if (!process.env.VITEST) process.stderr.write(msg);
L45: },
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
src/lib/mcp-oauth.jsView on unpkg · L30src/commands/init.jsView file
58L59: 通过本地 ComfyUI 服务（默认 http://localhost:8188）生成 AI 图像。
L60:
...
L99:
L100: const COMFYUI_URL = process.env.COMFYUI_URL || "http://localhost:8188";
L101: const POLL_INTERVAL_MS = 2000;
...
L118: res.on("end", () => {
L119: const data = Buffer.concat(dataChunks).toString("utf8");
L120: try {
L121: resolve({ status: res.statusCode, body: JSON.parse(data) });
L122: } catch {
...
L235: ? workflow
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/commands/init.jsView on unpkg · L58src/commands/update.jsView file
2import semver from "semver";
L3: import { execSync } from "node:child_process";
L4: import { checkForUpdates } from "../lib/version-checker.js";
...
L10: /**
L11: * A version that is safe to interpolate into `npm install -g chainlesschain@<v>`.
L12: * The version reaching selfUpdateCli already comes from version-checker (gated by
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
src/commands/update.jsView on unpkg · L2Findings
1 Critical7 High5 Medium9 Low
CriticalPrevious Version Dangerous Deltasrc/runtime/agent-core.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processsrc/auth/npm-auth.js
HighShellsrc/runtime/agent-core.js
HighSame File Env Network Executionsrc/lib/mcp-oauth.js
HighCommand Output Exfiltrationsrc/lib/mcp-oauth.js
HighSandbox Evasion Gated Capabilitysrc/commands/init.js
HighRuntime Package Installsrc/commands/update.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/postinstall.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalsrc/lib/plugin-ecosystem.js
LowWeak Cryptosrc/harness/prompt-compressor.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings