registry / chainlesschain / 0.162.159

chainlesschain@0.162.159

CLI for ChainlessChain - install, configure, and manage your personal AI management system

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On `npm install`, the package creates ChainlessChain-managed skill packs in its desktop user-data directory. Those packs can later execute allowlisted ChainlessChain CLI commands when invoked by the package's skill runtime; no exfiltration or foreign AI-agent takeover was confirmed.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall; later invocation of a generated ChainlessChain skill pack

Impact

Adds a persistent package-owned agent/skill capability that can run package CLI commands after installation.

Mechanism

Install-time first-party skill-extension generation with command-executing handlers

Rationale

Source inspection shows a real install-time persistence/capability surface, but it is confined to ChainlessChain-managed skill packs and lacks a concrete malicious chain. Warn rather than block under the first-party agent-extension lifecycle policy.

Evidence

package.jsonscripts/postinstall.mjssrc/lib/skill-packs/generator.jssrc/lib/paths.jssrc/commands/browse.jssrc/lib/chrome-connector.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`package.json` runs `node scripts/postinstall.mjs` on install.
`scripts/postinstall.mjs` imports and runs `generateCliPacks()` automatically.
`src/lib/skill-packs/generator.js` writes `SKILL.md` and `handler.js` under the ChainlessChain desktop user-data `skills` directory.
Generated direct/hybrid handlers invoke `chainlesschain` through `spawnSync` with `shell: true`; metacharacters are filtered first.

Evidence against

Postinstall contains no network request, credential collection, shell launch, or foreign-agent config path.
Generated files are package-defined ChainlessChain skill packs, not writes to `.claude`, `.codex`, `.cursor`, or similar foreign control surfaces.
Chrome CDP support is registered behind explicit `cc browse chrome` commands and restricts its connector endpoint to loopback.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 867 file(s), 15.4 MB of source, external domains: 127.0.0.1, accounts.google.com, api-push.vivo.com.cn, api.anthropic.com, api.bochaai.com, api.deepseek.com, api.example.com, api.exchangerate-api.com, api.github.com, api.minimax.chat, api.mistral.ai, api.moonshot.cn, api.openai.com, api.push.apple.com, api.push.oppomobile.com, api.sandbox.push.apple.com, api.search.brave.com, api.tavily.com, api.telegram.org, api.xmpush.xiaomi.com, ark.cn-beijing.volces.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, cli.github.com, cli.vuejs.org, dashscope.aliyuncs.com, dav.jianguoyun.com, developer.mozilla.org, devtools.vuejs.org, docs.chainlesschain.com, evomap.chainlesschain.com, example.com, fcm.googleapis.com, generativelanguage.googleapis.com, github.com, graph.microsoft.com, html.duckduckgo.com, link.vuejs.org, local.chainlesschain, login.microsoftonline.com, mathiasbynens.be, matrix.org, modelcontextprotocol.io, nas.example, node.example.com, oauth-login.cloud.huawei.com, oauth2.googleapis.com, openidconnect.googleapis.com, oss-cn-hangzhou.aliyuncs.com, pinia.vuejs.org

Source & flagged code

12 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.162.159",

4 "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",

5 "type": "module",

6 "bin": {

7 "chainlesschain": "./bin/chainlesschain.js",

8 "cc": "./bin/chainlesschain.js",

9 "clc": "./bin/chainlesschain.js",

10 "clchain": "./bin/chainlesschain.js"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "vitest run",

15 "test:unit": "vitest run __tests__/unit/",

16 "test:integration": "vitest run __tests__/integration/",

17 "test:e2e": "vitest run --config vitest.e2e.config.js __tests__/e2e/",

18 "test:all": "vitest run && vitest run --config vitest.e2e.config.js __tests__/e2e/",

19 "test:watch": "vitest watch",

20 "lint": "eslint src/ bin/ --ext .js",

21 "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\" \"__tests__/**/*.js\"",

22 "sync-skill-packs": "node --input-type=module -e \"import { generateCliPacks } from './src/lib/skill-packs/generator.js'; const r = await generateCliPacks({ force: false }); console.log('Skill packs synced:', r.generated.length, 'generated,', r.skipped.length, 'skipped');\"",

23 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "build:web-panel": "node scripts/build-web-panel.mjs",

25 "build:web-panel:force": "node scripts/build-web-panel.mjs --force",

26 "build:changelog": "node scripts/build-changelog.mjs",

27 "prepublishOnly": "npm run build:web-panel && npm run build:changelog"

28 },

29 "engines": {

30 "node": ">=22.12.0"

31 },

32 "files": [

33 "bin/",

34 "src/",

35 "scripts/postinstall.mjs",

36 "README.md"

37 ],

38 "keywords": [

39 "chainlesschain",

40 "ai",

41 "cli",

42 "electron",

43 "decentralized",

src/auth/npm-auth.jsView file

Lines 1-26javascript

1/**

2 * npm authentication utilities (ESM)

3 * Mirrors Claude Code /login /logout behavior

4 * @module auth/npm-auth

5 */

7import { execSync } from "child_process";

8import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/runtime/agent-core.jsView file

Lines 1243-1283javascript

1243 tool: name,

1244 args,

1245 rule: settingsVerdict.rule,

1246 reason: `settings rule ${settingsVerdict.rule} requires confirmation`,

1247 });

1248 if (!ok) {

1249 return {

src/lib/plugin-ecosystem.jsView file

Lines 66-106javascript

66});

68export const SANDBOX_RESULT = Object.freeze({

69 PASSED: "passed",

70 FAILED: "failed",

71 TIMEOUT: "timeout",

72 RESOURCE_EXCEEDED: "resource-exceeded",

73});

scripts/postinstall.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Runs after `npm install`. Best-effort only — must never fail the install.

3// Cross-platform: no shell redirects, no `|| true`.

5// 1) Pre-generate the CLI skill packs (best-effort).

6try {

7 const { generateCliPacks } = await import(

8 "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

src/harness/prompt-compressor.jsView file

Lines 660-700javascript

660 _pcompPsV2.clear();

661 _pcompRsV2.clear();

662 _pcompMaxActive = 8;

663 _pcompMaxPending = 20;

664 _pcompIdleMs = 30 * 24 * 60 *

src/lib/mcp-oauth.jsView file

Lines 10-50javascript

10 * RFC 7636 PKCE):

11 * 1. discover the protected-resource / authorization-server metadata;

12 * 2. register a public client (or use a configured client_id);

13 * 3. open the browser to the authorize URL,

src/commands/init.jsView file

58L59: 通过本地 ComfyUI 服务（默认 http://localhost:8188）生成 AI 图像。 L60: ... L99: L100: const COMFYUI_URL = process.env.COMFYUI_URL || "http://localhost:8188"; L101: const POLL_INTERVAL_MS = 2000; ... L118: res.on("end", () => { L119: const data = Buffer.concat(dataChunks).toString("utf8"); L120: try { L121: resolve({ status: res.statusCode, body: JSON.parse(data) }); L122: } catch { ... L235: ? workflow

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

2import semver from "semver"; L3: import { execSync } from "node:child_process"; L4: import { checkForUpdates } from "../lib/version-checker.js"; ... L10: /** L11: * A version that is safe to interpolate into `npm install -g chainlesschain@<v>`. L12: * The version reaching selfUpdateCli already comes from version-checker (gated by

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

src/lib/chrome-connector.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = chainlesschain@0.162.158 matchedIdentity = npm:Y2hhaW5sZXNzY2hhaW4:0.162.158 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/chrome-connector.jsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/auth/npm-auth.jsView file

6L7: import { execSync } from "child_process"; L8: import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/auth/npm-auth.jsView on unpkg · L6

src/runtime/agent-core.jsView file

1263// Sensitive-file write guard (Claude-Code 2.1.160 parity): shell startup L1264: // files / PowerShell profiles / git+husky hooks execute code on the user's L1265: // next shell or commit — even otherwise-permitted edit flows confirm first.

High

Shell

Package source references shell execution.

src/runtime/agent-core.jsView on unpkg · L1263

src/lib/plugin-ecosystem.jsView file

86severity: REVIEW_SEVERITY.BLOCKER, L87: message: "Use of eval() — code injection risk", L88: penalty: 40,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/plugin-ecosystem.jsView on unpkg · L86

scripts/postinstall.mjsView file

6try { L7: const { generateCliPacks } = await import( L8: "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.mjsView on unpkg · L6

src/harness/prompt-compressor.jsView file

680archivedAt: null, L681: metadata: { ...(metadata || {}) }, L682: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/harness/prompt-compressor.jsView on unpkg · L680

src/lib/mcp-oauth.jsView file

30export const _deps = { L31: fetch: (...a) => globalThis.fetch(...a), L32: fs: fsDefault, ... L37: openBrowser: defaultOpenBrowser, L38: spawn: (...a) => spawn(...a), L39: now: () => Date.now(), ... L43: warn: (msg) => { L44: if (!process.env.VITEST) process.stderr.write(msg); L45: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

src/commands/init.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

src/lib/chrome-connector.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/chrome-connector.jsView on unpkg

Findings

1 Critical7 High5 Medium9 Low

CriticalPrevious Version Dangerous Deltasrc/lib/chrome-connector.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/auth/npm-auth.js

HighShellsrc/runtime/agent-core.js

HighSame File Env Network Executionsrc/lib/mcp-oauth.js

HighCommand Output Exfiltrationsrc/lib/mcp-oauth.js

HighSandbox Evasion Gated Capabilitysrc/commands/init.js

HighRuntime Package Installsrc/commands/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/lib/plugin-ecosystem.js

LowWeak Cryptosrc/harness/prompt-compressor.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

87%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorChainlessChain Team

Maintainerslongfa

Version0.162.159

PublishedJul 11, 2026

LicenseMIT

Dependencies24

Integrityverified

Package size4.16 MB

Files1,003

Keywordschainlesschainaiclielectrondecentralizedknowledge-base

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → src/index.jsbin → cc, chainlesschain, clc +1

Runtimenode >=22.12.0

Artifact16.2 MB · 1,003 files1 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedTelemetryUrlStringsManifest: clean

Source & flagged code

12 flagged

package.jsonView file

Lines 3-43json

3 "version": "0.162.159",

4 "description": "CLI for ChainlessChain - install, configure, and manage your personal AI management system",

5 "type": "module",

6 "bin": {

7 "chainlesschain": "./bin/chainlesschain.js",

8 "cc": "./bin/chainlesschain.js",

9 "clc": "./bin/chainlesschain.js",

10 "clchain": "./bin/chainlesschain.js"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "vitest run",

15 "test:unit": "vitest run __tests__/unit/",

16 "test:integration": "vitest run __tests__/integration/",

17 "test:e2e": "vitest run --config vitest.e2e.config.js __tests__/e2e/",

18 "test:all": "vitest run && vitest run --config vitest.e2e.config.js __tests__/e2e/",

19 "test:watch": "vitest watch",

20 "lint": "eslint src/ bin/ --ext .js",

21 "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\" \"__tests__/**/*.js\"",

23 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "build:web-panel": "node scripts/build-web-panel.mjs",

25 "build:web-panel:force": "node scripts/build-web-panel.mjs --force",

26 "build:changelog": "node scripts/build-changelog.mjs",

27 "prepublishOnly": "npm run build:web-panel && npm run build:changelog"

28 },

29 "engines": {

30 "node": ">=22.12.0"

31 },

32 "files": [

33 "bin/",

34 "src/",

35 "scripts/postinstall.mjs",

36 "README.md"

37 ],

38 "keywords": [

39 "chainlesschain",

40 "ai",

41 "cli",

42 "electron",

43 "decentralized",

src/auth/npm-auth.jsView file

Lines 1-26javascript

1/**

2 * npm authentication utilities (ESM)

3 * Mirrors Claude Code /login /logout behavior

4 * @module auth/npm-auth

5 */

7import { execSync } from "child_process";

8import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/runtime/agent-core.jsView file

Lines 1243-1283javascript

1243 tool: name,

1244 args,

1245 rule: settingsVerdict.rule,

1246 reason: `settings rule ${settingsVerdict.rule} requires confirmation`,

1247 });

1248 if (!ok) {

1249 return {

src/lib/plugin-ecosystem.jsView file

Lines 66-106javascript

66});

68export const SANDBOX_RESULT = Object.freeze({

69 PASSED: "passed",

70 FAILED: "failed",

71 TIMEOUT: "timeout",

72 RESOURCE_EXCEEDED: "resource-exceeded",

73});

scripts/postinstall.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Runs after `npm install`. Best-effort only — must never fail the install.

3// Cross-platform: no shell redirects, no `|| true`.

5// 1) Pre-generate the CLI skill packs (best-effort).

6try {

7 const { generateCliPacks } = await import(

8 "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

src/harness/prompt-compressor.jsView file

Lines 660-700javascript

660 _pcompPsV2.clear();

661 _pcompRsV2.clear();

662 _pcompMaxActive = 8;

663 _pcompMaxPending = 20;

664 _pcompIdleMs = 30 * 24 * 60 *

src/lib/mcp-oauth.jsView file

Lines 10-50javascript

10 * RFC 7636 PKCE):

11 * 1. discover the protected-resource / authorization-server metadata;

12 * 2. register a public client (or use a configured client_id);

13 * 3. open the browser to the authorize URL,

src/commands/init.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

src/lib/chrome-connector.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/chrome-connector.jsView on unpkg