registry / chainlesschain / 0.162.148

chainlesschain@0.162.148

CLI for ChainlessChain - install, configure, and manage your personal AI management system

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time lifecycle generates first-party ChainlessChain skill packs under the package app namespace.

Static reason

One or more suspicious static signals were detected.; routed for review

Trigger

npm install of chainlesschain@0.162.148

Impact

Warn-level lifecycle expansion of a package-owned agent extension surface; no confirmed malware payload.

Mechanism

first-party package-owned agent extension setup via npm postinstall

Policy narrative

During npm install, the postinstall script generates ChainlessChain skill packs under the package own desktop app userData skills directory. The generated handlers are package-aligned and run chainlesschain subcommands with inherited environment. This is risky lifecycle-time agent extension setup, but it stays inside the first-party app namespace and no exfiltration, remote payload, permission bypass, or foreign agent-control mutation was confirmed.

Rationale

Policy repair: first-party package-owned agent extension setup inside the ChainlessChain app namespace is warn-only agent_extension_lifecycle_risk, not a product-default block. No foreign agent-control mutation, exfiltration, remote payload execution, permission bypass, or persistence outside the platform contract was confirmed.

Evidence

package.jsonscripts/postinstall.mjssrc/lib/skill-packs/generator.jssrc/lib/skill-packs/schema.jssrc/lib/paths.jssrc/lib/update-notice.js<ChainlessChain userData>/skills/*/SKILL.md<ChainlessChain userData>/skills/*/handler.js

Network endpoints1

registry.npmjs.org/chainlesschain/latest

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs a postinstall lifecycle script
scripts/postinstall.mjs generates ChainlessChain skill packs during install
generated handlers can run chainlesschain subcommands with inherited environment

Evidence against

skill packs are generated under the ChainlessChain app namespace rather than a foreign agent surface
handlers are package-aligned and generated from static package schemas
no credential exfiltration, destructive action, remote payload execution, or permission bypass was confirmed

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 765 file(s), 14.3 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.bochaai.com, api.deepseek.com, api.example.com, api.exchangerate-api.com, api.github.com, api.minimax.chat, api.mistral.ai, api.moonshot.cn, api.openai.com, api.search.brave.com, api.tavily.com, api.telegram.org, ark.cn-beijing.volces.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, cli.github.com, cli.vuejs.org, dashscope.aliyuncs.com, dav.jianguoyun.com, developer.mozilla.org, devtools.vuejs.org, docs.chainlesschain.com, evomap.chainlesschain.com, example.com, fcm.googleapis.com, generativelanguage.googleapis.com, github.com, graph.microsoft.com, html.duckduckgo.com, link.vuejs.org, local.chainlesschain, login.microsoftonline.com, mathiasbynens.be, matrix.org, modelcontextprotocol.io, nas.example, node.example.com, oauth2.googleapis.com, openidconnect.googleapis.com, oss-cn-hangzhou.aliyuncs.com, pinia.vuejs.org, python.org, qianfan.baidubce.com, registry.npmjs.org, router.vuejs.org, sso.example.com, tinyurl.com

Source & flagged code

11 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.162.148",

4 "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",

5 "type": "module",

6 "bin": {

7 "chainlesschain": "./bin/chainlesschain.js",

8 "cc": "./bin/chainlesschain.js",

9 "clc": "./bin/chainlesschain.js",

10 "clchain": "./bin/chainlesschain.js"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "vitest run",

15 "test:unit": "vitest run __tests__/unit/",

16 "test:integration": "vitest run __tests__/integration/",

17 "test:e2e": "vitest run --config vitest.e2e.config.js __tests__/e2e/",

18 "test:all": "vitest run && vitest run --config vitest.e2e.config.js __tests__/e2e/",

19 "test:watch": "vitest watch",

20 "lint": "eslint src/ bin/ --ext .js",

21 "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\" \"__tests__/**/*.js\"",

22 "sync-skill-packs": "node --input-type=module -e \"import { generateCliPacks } from './src/lib/skill-packs/generator.js'; const r = await generateCliPacks({ force: false }); console.log('Skill packs synced:', r.generated.length, 'generated,', r.skipped.length, 'skipped');\"",

23 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "build:web-panel": "node scripts/build-web-panel.mjs",

25 "build:web-panel:force": "node scripts/build-web-panel.mjs --force",

26 "prepublishOnly": "npm run build:web-panel"

27 },

28 "engines": {

29 "node": ">=22.12.0"

30 },

31 "files": [

32 "bin/",

33 "src/",

34 "scripts/postinstall.mjs",

35 "README.md"

36 ],

37 "keywords": [

38 "chainlesschain",

39 "ai",

40 "cli",

41 "electron",

42 "decentralized",

43 "knowledge-base"

src/auth/npm-auth.jsView file

Lines 1-26javascript

1/**

2 * npm authentication utilities (ESM)

3 * Mirrors Claude Code /login /logout behavior

4 * @module auth/npm-auth

5 */

7import { execSync } from "child_process";

8import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/runtime/agent-core.jsView file

Lines 1087-1127javascript

1087 args,

1088 rule: settingsVerdict.rule,

1089 reason: `settings rule ${settingsVerdict.rule} requires confirmation`,

1090 })

1091 : false;

1092 if (!ok) {

1093 return {

src/lib/plugin-ecosystem.jsView file

Lines 66-106javascript

66});

68export const SANDBOX_RESULT = Object.freeze({

69 PASSED: "passed",

70 FAILED: "failed",

71 TIMEOUT: "timeout",

72 RESOURCE_EXCEEDED: "resource-exceeded",

73});

scripts/postinstall.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Runs after `npm install`. Best-effort only — must never fail the install.

3// Cross-platform: no shell redirects, no `|| true`.

5// 1) Pre-generate the CLI skill packs (best-effort).

6try {

7 const { generateCliPacks } = await import(

8 "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

src/harness/prompt-compressor.jsView file

Lines 634-674javascript

634 _pcompPsV2.clear();

635 _pcompRsV2.clear();

636 _pcompMaxActive = 8;

637 _pcompMaxPending = 20;

638 _pcompIdleMs = 30 * 24 * 60 *

src/lib/mcp-oauth.jsView file

Lines 10-50javascript

10 * RFC 7636 PKCE):

11 * 1. discover the protected-resource / authorization-server metadata;

12 * 2. register a public client (or use a configured client_id);

13 * 3. open the browser to the authorize URL,

src/commands/init.jsView file

58L59: 通过本地 ComfyUI 服务（默认 http://localhost:8188）生成 AI 图像。 L60: ... L99: L100: const COMFYUI_URL = process.env.COMFYUI_URL || "http://localhost:8188"; L101: const POLL_INTERVAL_MS = 2000; ... L118: res.on("end", () => { L119: const data = Buffer.concat(dataChunks).toString("utf8"); L120: try { L121: resolve({ status: res.statusCode, body: JSON.parse(data) }); L122: } catch { ... L235: ? workflow

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

2import semver from "semver"; L3: import { execSync } from "node:child_process"; L4: import { checkForUpdates } from "../lib/version-checker.js"; ... L10: /** L11: * A version that is safe to interpolate into `npm install -g chainlesschain@<v>`. L12: * The version reaching selfUpdateCli already comes from version-checker (gated by

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/auth/npm-auth.jsView file

6L7: import { execSync } from "child_process"; L8: import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/auth/npm-auth.jsView on unpkg · L6

src/runtime/agent-core.jsView file

1107// Sensitive-file write guard (Claude-Code 2.1.160 parity): shell startup L1108: // files / PowerShell profiles / git+husky hooks execute code on the user's L1109: // next shell or commit — even otherwise-permitted edit flows confirm first.

High

Shell

Package source references shell execution.

src/runtime/agent-core.jsView on unpkg · L1107

src/lib/plugin-ecosystem.jsView file

86severity: REVIEW_SEVERITY.BLOCKER, L87: message: "Use of eval() — code injection risk", L88: penalty: 40,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/plugin-ecosystem.jsView on unpkg · L86

scripts/postinstall.mjsView file

6try { L7: const { generateCliPacks } = await import( L8: "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.mjsView on unpkg · L6

src/harness/prompt-compressor.jsView file

654archivedAt: null, L655: metadata: { ...(metadata || {}) }, L656: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/harness/prompt-compressor.jsView on unpkg · L654

src/lib/mcp-oauth.jsView file

30export const _deps = { L31: fetch: (...a) => globalThis.fetch(...a), L32: fs: fsDefault, ... L37: openBrowser: defaultOpenBrowser, L38: spawn: (...a) => spawn(...a), L39: now: () => Date.now(), ... L43: warn: (msg) => { L44: if (!process.env.VITEST) process.stderr.write(msg); L45: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

src/commands/init.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

Findings

7 High5 Medium9 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/auth/npm-auth.js

HighShellsrc/runtime/agent-core.js

HighSame File Env Network Executionsrc/lib/mcp-oauth.js

HighCommand Output Exfiltrationsrc/lib/mcp-oauth.js

HighSandbox Evasion Gated Capabilitysrc/commands/init.js

HighRuntime Package Installsrc/commands/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/lib/plugin-ecosystem.js

LowWeak Cryptosrc/harness/prompt-compressor.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

91%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorChainlessChain Team

Version0.162.148

PublishedJul 3, 2026

LicenseMIT

Dependencies24

Integrityverified

Package size3.77 MB

Files888

Keywordschainlesschainaiclielectrondecentralizedknowledge-base

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → src/index.jsbin → cc, chainlesschain, clc +1

Runtimenode >=22.12.0

Artifact14.9 MB · 888 files1 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedTelemetryUrlStringsManifest: clean

Source & flagged code

11 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.162.148",

4 "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",

5 "type": "module",

6 "bin": {

7 "chainlesschain": "./bin/chainlesschain.js",

8 "cc": "./bin/chainlesschain.js",

9 "clc": "./bin/chainlesschain.js",

10 "clchain": "./bin/chainlesschain.js"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "vitest run",

15 "test:unit": "vitest run __tests__/unit/",

16 "test:integration": "vitest run __tests__/integration/",

17 "test:e2e": "vitest run --config vitest.e2e.config.js __tests__/e2e/",

18 "test:all": "vitest run && vitest run --config vitest.e2e.config.js __tests__/e2e/",

19 "test:watch": "vitest watch",

20 "lint": "eslint src/ bin/ --ext .js",

21 "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\" \"__tests__/**/*.js\"",

23 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "build:web-panel": "node scripts/build-web-panel.mjs",

25 "build:web-panel:force": "node scripts/build-web-panel.mjs --force",

26 "prepublishOnly": "npm run build:web-panel"

27 },

28 "engines": {

29 "node": ">=22.12.0"

30 },

31 "files": [

32 "bin/",

33 "src/",

34 "scripts/postinstall.mjs",

35 "README.md"

36 ],

37 "keywords": [

38 "chainlesschain",

39 "ai",

40 "cli",

41 "electron",

42 "decentralized",

43 "knowledge-base"

src/auth/npm-auth.jsView file

Lines 1-26javascript

1/**

2 * npm authentication utilities (ESM)

3 * Mirrors Claude Code /login /logout behavior

4 * @module auth/npm-auth

5 */

7import { execSync } from "child_process";

8import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/runtime/agent-core.jsView file

Lines 1087-1127javascript

1087 args,

1088 rule: settingsVerdict.rule,

1089 reason: `settings rule ${settingsVerdict.rule} requires confirmation`,

1090 })

1091 : false;

1092 if (!ok) {

1093 return {

src/lib/plugin-ecosystem.jsView file

Lines 66-106javascript

66});

68export const SANDBOX_RESULT = Object.freeze({

69 PASSED: "passed",

70 FAILED: "failed",

71 TIMEOUT: "timeout",

72 RESOURCE_EXCEEDED: "resource-exceeded",

73});

scripts/postinstall.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Runs after `npm install`. Best-effort only — must never fail the install.

3// Cross-platform: no shell redirects, no `|| true`.

5// 1) Pre-generate the CLI skill packs (best-effort).

6try {

7 const { generateCliPacks } = await import(

8 "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

src/harness/prompt-compressor.jsView file

Lines 634-674javascript

634 _pcompPsV2.clear();

635 _pcompRsV2.clear();

636 _pcompMaxActive = 8;

637 _pcompMaxPending = 20;

638 _pcompIdleMs = 30 * 24 * 60 *

src/lib/mcp-oauth.jsView file

Lines 10-50javascript

10 * RFC 7636 PKCE):

11 * 1. discover the protected-resource / authorization-server metadata;

12 * 2. register a public client (or use a configured client_id);

13 * 3. open the browser to the authorize URL,

src/commands/init.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2