registry / chainlesschain / 0.162.165

chainlesschain@0.162.165

CLI for ChainlessChain - install, configure, and manage your personal AI management system

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package automatically generates ChainlessChain CLI skill packs in its desktop user-data directory. Those packs can later dispatch allowed ChainlessChain CLI commands; no install-time exfiltration or remote payload path was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install for `chainlesschain`

Impact

Adds executable integration handlers to the package's own managed skills directory; runtime hook execution depends on configured settings hooks.

Mechanism

package-owned agent skill-pack creation during postinstall

Rationale

No concrete malware behavior, secret exfiltration, remote payload retrieval, or foreign control-surface mutation was found. The unprompted first-party skill integration written during postinstall is a lifecycle risk requiring a warning under the stated policy.

Evidence

package.jsonscripts/postinstall.mjssrc/lib/skill-packs/generator.jssrc/lib/paths.jssrc/constants.jssrc/lib/async-hook-supervisor.cjssrc/lib/settings-hook-events.cjssrc/lib/secret-scan.jssrc/commands/update.jssrc/auth/npm-auth.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`package.json` runs `scripts/postinstall.mjs` on install.
`scripts/postinstall.mjs` imports `src/lib/skill-packs/generator.js` without user interaction.
`src/lib/skill-packs/generator.js` writes `SKILL.md` and `handler.js` into the ChainlessChain desktop user-data `skills/` directory.
Generated direct-mode handlers invoke the package CLI through `spawnSync(..., { shell: true })`.
`src/lib/async-hook-supervisor.cjs` can shell-spawn configured async settings hooks at runtime.

Evidence against

Postinstall has no network API, credential collection, shell execution, or external payload download.
The install-time writes target package-owned `chainlesschain-desktop-vue` user data, not a foreign agent configuration.
Generated handlers validate command membership and reject shell metacharacters before execution.
`src/lib/secret-scan.js` is a redaction/scanning utility; embedded secret-shaped strings are test corpus samples.
`src/commands/update.js` and `src/auth/npm-auth.js` run npm commands only through explicit CLI actions.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 920 file(s), 16.1 MB of source, external domains: 127.0.0.1, accounts.google.com, api-push.vivo.com.cn, api.anthropic.com, api.bochaai.com, api.deepseek.com, api.example.com, api.exchangerate-api.com, api.github.com, api.minimax.chat, api.mistral.ai, api.moonshot.cn, api.openai.com, api.push.apple.com, api.push.oppomobile.com, api.sandbox.push.apple.com, api.search.brave.com, api.tavily.com, api.telegram.org, api.xmpush.xiaomi.com, ark.cn-beijing.volces.com, cdn.jsdelivr.net, cdnjs.cloudflare.com, cli.github.com, cli.vuejs.org, dashscope.aliyuncs.com, dav.jianguoyun.com, developer.mozilla.org, devtools.vuejs.org, docs.chainlesschain.com, evomap.chainlesschain.com, example.com, fcm.googleapis.com, generativelanguage.googleapis.com, github.com, graph.microsoft.com, html.duckduckgo.com, link.vuejs.org, local.chainlesschain, login.microsoftonline.com, mathiasbynens.be, matrix.org, modelcontextprotocol.io, nas.example, node.example.com, oauth-login.cloud.huawei.com, oauth2.googleapis.com, openidconnect.googleapis.com, oss-cn-hangzhou.aliyuncs.com, pinia.vuejs.org

Source & flagged code

19 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "bin": {

7 "chainlesschain": "./bin/chainlesschain.js",

8 "cc": "./bin/chainlesschain.js",

9 "clc": "./bin/chainlesschain.js",

10 "clchain": "./bin/chainlesschain.js"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "vitest run",

15 "test:unit": "vitest run __tests__/unit/",

16 "test:integration": "vitest run __tests__/integration/",

17 "test:e2e": "vitest run --config vitest.e2e.config.js __tests__/e2e/",

18 "test:all": "vitest run && vitest run --config vitest.e2e.config.js __tests__/e2e/",

19 "test:watch": "vitest watch",

20 "lint": "eslint src/ bin/ --ext .js",

21 "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\" \"__tests__/**/*.js\"",

22 "sync-skill-packs": "node --input-type=module -e \"import { generateCliPacks } from './src/lib/skill-packs/generator.js'; const r = await generateCliPacks({ force: false }); console.log('Skill packs synced:', r.generated.length, 'generated,', r.skipped.length, 'skipped');\"",

23 "docs:cli-reference": "node scripts/gen-cli-reference.mjs --out ../../docs/cli/CLI_REFERENCE.generated.md",

24 "docs:cli-reference:check": "node scripts/gen-cli-reference.mjs --check ../../docs/cli/CLI_REFERENCE.generated.md",

25 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "build:web-panel": "node scripts/build-web-panel.mjs",

27 "build:web-panel:force": "node scripts/build-web-panel.mjs --force",

28 "build:changelog": "node scripts/build-changelog.mjs",

29 "prepublishOnly": "npm run build:web-panel && npm run build:changelog"

30 },

31 "engines": {

32 "node": ">=22.12.0"

33 },

34 "files": [

35 "bin/",

36 "src/",

37 "scripts/postinstall.mjs",

38 "README.md"

39 ],

40 "keywords": [

41 "chainlesschain",

42 "ai",

43 "cli",

44 "electron",

45 "decentralized",

src/lib/secret-scan.jsView file

Lines 166-206javascript

166

167// ── Labeled corpus ───────────────────────────────────────────────────────────

168//

169// Positives carry the exact `secret` substring that MUST disappear after

170// redaction; negatives (sample/placeholder values, hashes, UUIDs, plain base64,

171// ordinary code) MUST pass through byte-for-byte. Items are spread across the

172// export surfaces so the benchmark can report per-surface.

173

174const POSITIVES = [

175 {

176

src/auth/npm-auth.jsView file

Lines 1-26javascript

1/**

2 * npm authentication utilities (ESM)

3 * Mirrors Claude Code /login /logout behavior

4 * @module auth/npm-auth

5 */

7import { execSync } from "child_process";

8import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/runtime/agent-core.jsView file

Lines 1288-1328javascript

1288 tool: name,

1289 args,

1290 rule: settingsVerdict.rule,

1291 reason: `settings rule ${settingsVerdict.rule} requires confirmation`,

1292 });

1293 if (!ok) {

1294 return {

src/lib/plugin-ecosystem.jsView file

Lines 66-106javascript

66});

68export const SANDBOX_RESULT = Object.freeze({

69 PASSED: "passed",

70 FAILED: "failed",

71 TIMEOUT: "timeout",

72 RESOURCE_EXCEEDED: "resource-exceeded",

73});

scripts/postinstall.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Runs after `npm install`. Best-effort only — must never fail the install.

3// Cross-platform: no shell redirects, no `|| true`.

5// 1) Pre-generate the CLI skill packs (best-effort).

6try {

7 const { generateCliPacks } = await import(

8 "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

src/harness/prompt-compressor.jsView file

Lines 660-700javascript

660 _pcompPsV2.clear();

661 _pcompRsV2.clear();

662 _pcompMaxActive = 8;

663 _pcompMaxPending = 20;

664 _pcompIdleMs = 30 * 24 * 60 *

src/lib/mcp-oauth.jsView file

30export const _deps = { L31: fetch: (...a) => globalThis.fetch(...a), L32: fs: fsDefault, ... L37: openBrowser: defaultOpenBrowser, L38: spawn: (...a) => spawn(...a), L39: now: () => Date.now(), ... L43: warn: (msg) => { L44: if (!process.env.VITEST) process.stderr.write(msg); L45: },

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

src/commands/init.jsView file

58L59: 通过本地 ComfyUI 服务（默认 http://localhost:8188）生成 AI 图像。 L60: ... L99: L100: const COMFYUI_URL = process.env.COMFYUI_URL || "http://localhost:8188"; L101: const POLL_INTERVAL_MS = 2000; ... L118: res.on("end", () => { L119: const data = Buffer.concat(dataChunks).toString("utf8"); L120: try { L121: resolve({ status: res.statusCode, body: JSON.parse(data) }); L122: } catch { ... L235: ? workflow

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

2import semver from "semver"; L3: import { execSync } from "node:child_process"; L4: import { checkForUpdates } from "../lib/version-checker.js"; ... L10: /** L11: * A version that is safe to interpolate into `npm install -g chainlesschain@<v>`. L12: * The version reaching selfUpdateCli already comes from version-checker (gated by

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

src/lib/async-hook-supervisor.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = chainlesschain@0.162.163 matchedIdentity = npm:Y2hhaW5sZXNzY2hhaW4:0.162.163 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/async-hook-supervisor.cjsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/lib/secret-scan.jsView file

186patternName = github_pat severity = critical line = 186 matchedText = secret: ...89",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

src/lib/secret-scan.jsView on unpkg · L186

186patternName = github_pat severity = critical line = 186 matchedText = secret: ...89",

Critical

Secret Pattern

GitHub personal access token in src/lib/secret-scan.js

src/lib/secret-scan.jsView on unpkg · L186

187patternName = github_pat severity = critical line = 187 matchedText = text: "g.../y",

Critical

Secret Pattern

GitHub personal access token in src/lib/secret-scan.js

src/lib/secret-scan.jsView on unpkg · L187

193patternName = aws_access_key severity = critical line = 193 matchedText = secret: ...LE",

Critical

Secret Pattern

AWS access key ID in src/lib/secret-scan.js

src/lib/secret-scan.jsView on unpkg · L193

194patternName = aws_access_key severity = critical line = 194 matchedText = text: "a...LE",

Critical

Secret Pattern

AWS access key ID in src/lib/secret-scan.js

src/lib/secret-scan.jsView on unpkg · L194

216patternName = private_key_rsa severity = critical line = 216 matchedText = "-----BE...--",

Critical

Secret Pattern

RSA private key in src/lib/secret-scan.js

src/lib/secret-scan.jsView on unpkg · L216

217patternName = private_key_rsa severity = critical line = 217 matchedText = text: "k...\n",

Critical

Secret Pattern

RSA private key in src/lib/secret-scan.js

src/lib/secret-scan.jsView on unpkg · L217

src/auth/npm-auth.jsView file

6L7: import { execSync } from "child_process"; L8: import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/auth/npm-auth.jsView on unpkg · L6

src/runtime/agent-core.jsView file

1308// Sensitive-file write guard (Claude-Code 2.1.160 parity): shell startup L1309: // files / PowerShell profiles / git+husky hooks execute code on the user's L1310: // next shell or commit — even otherwise-permitted edit flows confirm first.

High

Shell

Package source references shell execution.

src/runtime/agent-core.jsView on unpkg · L1308

src/lib/plugin-ecosystem.jsView file

86severity: REVIEW_SEVERITY.BLOCKER, L87: message: "Use of eval() — code injection risk", L88: penalty: 40,

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/lib/plugin-ecosystem.jsView on unpkg · L86

scripts/postinstall.mjsView file

6try { L7: const { generateCliPacks } = await import( L8: "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.mjsView on unpkg · L6

src/harness/prompt-compressor.jsView file

680archivedAt: null, L681: metadata: { ...(metadata || {}) }, L682: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/harness/prompt-compressor.jsView on unpkg · L680

src/lib/mcp-oauth.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

src/commands/init.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

src/lib/async-hook-supervisor.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/async-hook-supervisor.cjsView on unpkg

Findings

8 Critical7 High5 Medium9 Low

CriticalCritical Secretsrc/lib/secret-scan.js

CriticalPrevious Version Dangerous Deltasrc/lib/async-hook-supervisor.cjs

CriticalSecret Patternsrc/lib/secret-scan.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processsrc/auth/npm-auth.js

HighShellsrc/runtime/agent-core.js

HighSame File Env Network Executionsrc/lib/mcp-oauth.js

HighCommand Output Exfiltrationsrc/lib/mcp-oauth.js

HighSandbox Evasion Gated Capabilitysrc/commands/init.js

HighRuntime Package Installsrc/commands/update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/postinstall.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalsrc/lib/plugin-ecosystem.js

LowWeak Cryptosrc/harness/prompt-compressor.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

86%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorChainlessChain Team

Maintainerslongfa

Version0.162.165

PublishedJul 13, 2026

LicenseMIT

Dependencies24

Integrityverified

Package size4.39 MB

Files1,057

Keywordschainlesschainaiclielectrondecentralizedknowledge-base

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → src/index.jsbin → cc, chainlesschain, clc +1

Runtimenode >=22.12.0

Artifact16.9 MB · 1,057 files1 signature(s) · provenance

Install lifecyclepostinstallprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocketHighEntropyStringsMinifiedObfuscatedTelemetryUrlStringsManifest: clean

Source & flagged code

19 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "bin": {

7 "chainlesschain": "./bin/chainlesschain.js",

8 "cc": "./bin/chainlesschain.js",

9 "clc": "./bin/chainlesschain.js",

10 "clchain": "./bin/chainlesschain.js"

11 },

12 "main": "src/index.js",

13 "scripts": {

14 "test": "vitest run",

15 "test:unit": "vitest run __tests__/unit/",

16 "test:integration": "vitest run __tests__/integration/",

17 "test:e2e": "vitest run --config vitest.e2e.config.js __tests__/e2e/",

18 "test:all": "vitest run && vitest run --config vitest.e2e.config.js __tests__/e2e/",

19 "test:watch": "vitest watch",

20 "lint": "eslint src/ bin/ --ext .js",

21 "format": "prettier --write \"src/**/*.js\" \"bin/**/*.js\" \"__tests__/**/*.js\"",

23 "docs:cli-reference": "node scripts/gen-cli-reference.mjs --out ../../docs/cli/CLI_REFERENCE.generated.md",

24 "docs:cli-reference:check": "node scripts/gen-cli-reference.mjs --check ../../docs/cli/CLI_REFERENCE.generated.md",

25 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "build:web-panel": "node scripts/build-web-panel.mjs",

27 "build:web-panel:force": "node scripts/build-web-panel.mjs --force",

28 "build:changelog": "node scripts/build-changelog.mjs",

29 "prepublishOnly": "npm run build:web-panel && npm run build:changelog"

30 },

31 "engines": {

32 "node": ">=22.12.0"

33 },

34 "files": [

35 "bin/",

36 "src/",

37 "scripts/postinstall.mjs",

38 "README.md"

39 ],

40 "keywords": [

41 "chainlesschain",

42 "ai",

43 "cli",

44 "electron",

45 "decentralized",

src/lib/secret-scan.jsView file

Lines 166-206javascript

166

168//

169// Positives carry the exact `secret` substring that MUST disappear after

170// redaction; negatives (sample/placeholder values, hashes, UUIDs, plain base64,

171// ordinary code) MUST pass through byte-for-byte. Items are spread across the

172// export surfaces so the benchmark can report per-surface.

173

174const POSITIVES = [

175 {

176

src/auth/npm-auth.jsView file

Lines 1-26javascript

1/**

2 * npm authentication utilities (ESM)

3 * Mirrors Claude Code /login /logout behavior

4 * @module auth/npm-auth

5 */

7import { execSync } from "child_process";

8import { logger } from "../lib/logger.js";

High

Child Process

Package source references child process execution.

src/runtime/agent-core.jsView file

Lines 1288-1328javascript

1288 tool: name,

1289 args,

1290 rule: settingsVerdict.rule,

1291 reason: `settings rule ${settingsVerdict.rule} requires confirmation`,

1292 });

1293 if (!ok) {

1294 return {

src/lib/plugin-ecosystem.jsView file

Lines 66-106javascript

66});

68export const SANDBOX_RESULT = Object.freeze({

69 PASSED: "passed",

70 FAILED: "failed",

71 TIMEOUT: "timeout",

72 RESOURCE_EXCEEDED: "resource-exceeded",

73});

scripts/postinstall.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2// Runs after `npm install`. Best-effort only — must never fail the install.

3// Cross-platform: no shell redirects, no `|| true`.

5// 1) Pre-generate the CLI skill packs (best-effort).

6try {

7 const { generateCliPacks } = await import(

8 "../src/lib/skill-packs/generator.js"

Medium

Dynamic Require

src/harness/prompt-compressor.jsView file

Lines 660-700javascript

660 _pcompPsV2.clear();

661 _pcompRsV2.clear();

662 _pcompMaxActive = 8;

663 _pcompMaxPending = 20;

664 _pcompIdleMs = 30 * 24 * 60 *

src/lib/mcp-oauth.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/lib/mcp-oauth.jsView on unpkg · L30

src/commands/init.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/init.jsView on unpkg · L58

src/commands/update.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L2

src/lib/async-hook-supervisor.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/lib/async-hook-supervisor.cjsView on unpkg