Loading npm security reports…

cli-jaw: Suspicious npm security report (Warn) | LPM Firewall

registry / cli-jaw / 2.17.71

cli-jaw@2.17.71

Personal AI assistant powered by Pi, Antigravity, Claude, Codex, Codex App, Cursor, Grok, Kiro, OpenCode, and Copilot — Web, Terminal, Slack, Telegram, and Discord interfaces with 33 skills active by default from a 230-skill reference library

AI Security Review

scanned 17h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack was identified. On server startup, the package may set up its own Computer Use MCP integration in existing assistant configuration files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting the cli-jaw server when the user home has a cli-jaw MCP configuration and a resolvable Computer Use plugin.

Impact

Enables the package’s Computer Use integration in supported assistants; the inspected code does not establish credential theft or another attack.

Mechanism

Adds or updates the package-managed proxy entry in recognized assistant MCP configuration files, while preserving unrecognized entries.

AI rationale

The server’s startup path can add a package-owned MCP proxy to multiple assistant configurations, a concrete agent integration capability. The inspected path is conditional and preserves unrecognized entries, so this supports a warning for integration lifecycle risk, not a malware block.

Evidence

dist/server.jsdist/lib/mcp/computer-use-config.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Starting the server calls ensureComputerUseMcp, which can add a package-owned Computer Use MCP entry to existing assistant configuration files.

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-guard.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin/postinstall.jsView file

24import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, migrateAllJawHomes, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js';

High

Child Process

Package source references child process execution.

dist/bin/postinstall.jsView on unpkg · L24

5console.error(`[jaw:init] ❌ Node.js >= 22 required (current: ${process.version})`); L6: console.error(`[jaw:init] Install: https://nodejs.org or nvm install 22`); L7: process.exit(1); ... L24: import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, migrateAllJawHomes, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js'; ... L29: let execFileAdapter = execFileSync; L30: let toolPlatform = process.platform; L31: /** Test seam. Returns a restore function. Not for production use. */ ... L61: const JAW_HOME = (() => { L62: if (!process.env["CLI_JAW_HOME"]) L63: return path.join(os.homedir(), '.cli-jaw');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/postinstall.jsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/postinstall.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/postinstall.jsView on unpkg

dist/bin/commands/doctor.jsView file

110const installHint = process.platform === 'win32' L111: ? 'powershell -ExecutionPolicy Bypass -File "$(npm root -g)\\cli-jaw\\scripts\\install-officecli.ps1" -Update' L112: : 'bash "$(npm root -g)/cli-jaw/scripts/install-officecli.sh"';

High

Shell

Package source references shell execution.

dist/bin/commands/doctor.jsView on unpkg · L110

565const installHint = process.platform === 'win32' L566: ? 'powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"' L567: : 'curl -LsSf https://astral.sh/uv/install.sh | sh'; ... L576: // works, so it has to ask the question against `getconf PATH` instead of L577: // process.env.PATH. L578: if (process.platform !== 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/commands/doctor.jsView on unpkg · L565

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/doctor.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/doctor.jsView on unpkg

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView file

98// eslint-disable-next-line no-new-func -- vendored bundle injection on CSP-strict pages L99: new Function(src)(); L100: }, source);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView on unpkg · L98

dist/src/ide/diff.jsView file

7*/ L8: import { execFileSync, execFile } from 'node:child_process'; L9: import { writeFileSync, mkdtempSync, mkdirSync, statSync, realpathSync, rmSync, readFileSync } from 'node:fs'; ... L139: // Antigravity: 여러 env 시그널 확인 (VS Code 포크라서 VSCODE_* 도 공존) L140: if (process.env["ANTIGRAVITY_AGENT"] === '1') L141: return 'antigravity';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/ide/diff.jsView on unpkg · L7

dist/bin/commands/launchd.jsView file

9Trigger-reachable persistence chain: manifest.bin -> dist/bin/cli-jaw.js -> dist/bin/commands/launchd.js L9: */ L10: import { execSync } from 'node:child_process'; L11: import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from 'node:fs'; ... L16: import { asRecord, errString } from '../_http-client.js'; L17: if (process.argv[2] === 'launchd' && !process.env["_CLI_JAW_SERVICE_DELEGATE"]) { L18: console.error(' ⚠️ jaw launchd is deprecated. Use jaw service instead (cross-platform).'); ... L42: const LABEL = `com.cli-jaw.${INSTANCE}`; L43: const PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); L44: const LOG_DIR = join(JAW_HOME, 'logs'); ... L75: try { L76: execSync(`launchctl print ${GUI_DOMAIN}/${LABEL}`, { stdio: 'pipe' }); L77: return tru

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/bin/commands/launchd.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/launchd.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/launchd.jsView on unpkg

9*/ L10: import { execSync } from 'node:child_process'; L11: import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from 'node:fs'; ... L16: import { asRecord, errString } from '../_http-client.js'; L17: if (process.argv[2] === 'launchd' && !process.env["_CLI_JAW_SERVICE_DELEGATE"]) { L18: console.error(' ⚠️ jaw launchd is deprecated. Use jaw service instead (cross-platform).'); ... L42: const LABEL = `com.cli-jaw.${INSTANCE}`; L43: const PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); L44: const LOG_DIR = join(JAW_HOME, 'logs'); ... L75: try { L76: execSync(`launchctl print ${GUI_DOMAIN}/${LABEL}`, { stdio: 'pipe' }); L77: return true;

dist/bin/commands/skill.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { readfilesync, writefilesync, existssync, mkdirsync, rmsync, cpsync } from 'node:fs'; import { join } from 'node:path'; import { homedir } from 'node:os'; import { execsync } from 'node:child_process'; import { jaw_home, skills_dir } from '../../src/core/config.js'; import { dedupeskilldirentries } from '../../lib/mcp/sk[redacted]'; import { resolveskillid, legacyskillidnotice } from '../../lib/mcp/sk[redacted]'; const codex_skills = join(homedir(), '.codex', 'skills'); const ref_dir = join(jaw_home, 'skills_ref'); const c = { reset: '\x1b[0m

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bin/commands/skill.jsView on unpkg

public/dist/assets/MilkdownWysiwygEditor-BK26KbJ4.jsView file

142contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

public/dist/assets/MilkdownWysiwygEditor-BK26KbJ4.jsView on unpkg · L142

dist/bin/commands/mcp.jsView file

11* Package detection: L12: * npm: @scope/name or name → npm i -g <pkg> L13: * pypi: name (with --pypi flag) → uv tool install <pkg> / pip install <pkg> ... L15: */ L16: import { execSync, execFileSync } from 'node:child_process'; L17: import { readFileSync, existsSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/commands/mcp.jsView on unpkg · L11

scripts/check-deps-online.shView file

•path = scripts/check-deps-online.sh kind = build_helper sizeBytes = 912 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-deps-online.shView on unpkg

dist/bin/commands/clone.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/commands/clone.js#virtual:normalized:round1View on unpkg

scripts/postinstall-guard.cjsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = scripts/postinstall-guard.cjs matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-guard.cjsView on unpkg

dist/src/cli/capability-probe-worker.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/cli/capability-probe-worker.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/capability-probe-worker.jsView on unpkg

dist/src/routes/quota.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/routes/quota.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/routes/quota.jsView on unpkg

dist/bin/commands/chat.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/chat.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/chat.jsView on unpkg

dist/bin/commands/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/dashboard.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/dashboard.jsView on unpkg

dist/lib/mcp/skills-reset.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/lib/mcp/sk[redacted] matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/mcp/skills-reset.jsView on unpkg

dist/lib/quota-copilot.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/lib/quota-copilot.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/quota-copilot.jsView on unpkg

dist/src/agent/codex-app-client.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/agent/codex-app-client.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/agent/codex-app-client.jsView on unpkg

dist/src/cli/capability-probe.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/cli/capability-probe.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/capability-probe.jsView on unpkg

Lines 139-179javascript

139 console.log(` ✅ ${name}: ${detail || 'OK'}`);

140 }

141 catch (e) {

142 const isWarn = e.message?.startsWith('WARN:');

143 const status = isWarn ? 'warn' : 'error';

144 const msg = e.message?.replace(/^WARN:\s*/, '') || 'unknown';

145 results.push({ name, status, detail: msg });

146 if (!values.json) {

147 console.log(` ${isWarn ? '⚠️ ' : '❌'} ${name}: ${msg}`);

148 }

149 }

150}

151function resolvePackageRoot() {

152 // Compiled location is dist/bin/commands/doctor.js, so walk up until the

153 // directory actually holding package.json (same fallback as bin/cli-jaw.ts).

154 let packageRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..');

155 if (!fs.existsSync(path.join(packageRoot, 'package.json'))) {

156 packageRoot = path.join(packageRoot, '..');

157 }

158 return packageRoot;

159}

160const require_ = createRequire(import.meta.url);

161const { listStaleStaging } = require_(path.join(resolvePackageRoot(), 'scripts', 'staging-cleanup.cjs'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/commands/doctor.jsView on unpkg · L159

162console.log(!values.json ? '\n 🦈 cli-jaw doctor\n' : '');

163// 1. Home directory

164check('Home directory', () => {

165 if (!fs.existsSync(JAW_HOME)) {

166 fs.mkdirSync(JAW_HOME, { recursive: true });

167 }

168 fs.accessSync(JAW_HOME, fs.constants.W_OK);

169 return JAW_HOME;

170});

171// 1b. Install scripts — npm >= 12 blocks unreviewed dependency lifecycle

172// scripts, so a "successful" global install may have skipped our postinstall.

173// The install-state receipt (or the jaw-init setup marker) tells them apart.

174check('Install scripts', () => {

175 const packageRoot = resolvePackageRoot();

176 const integrity = inspectInstallIntegrity(packageRoot, JAW_HOME);

177 if (integrity.installScriptState === 'completed') {

178 return integrity.userSetupDone ? 'ran (setup complete)' : 'ran';

179 }

Lines 545-585javascript

545 });

546 return 'granted';

547 }

548 catch {

549 // Auto-open System Preferences

550 try {

551 execSync('open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"', { stdio: 'pipe' });

552 }

553 catch { } // best-effort: opening System Preferences can fail on headless/CI

554 throw new Error('WARN: 접근성 권한 필요 → 시스템 설정을 열었습니다. Terminal을 추가해주세요');

555 }

556 });

557}

558// 9. Skill dependencies (Phase 9)

559check('uv (Python)', () => {

560 try {

561 const ver = execSync('uv --version', { encoding: 'utf8', stdio: 'pipe' }).trim();

562 return ver;

563 }

564 catch {

565 const installHint = process.platform === 'win32'

566 ? 'powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"'

567 : 'curl -LsSf https://astral.sh/uv/install.sh | sh';

568 throw new Error(`WARN: not installed — run: ${installHint}`);

569 }

570});

571// 9b. Non-interactive shell reachability (#479)

572//

573// Remote one-shot commands (`ssh host 'jaw serve ...'`) run a shell that

574// reads none of the profile files the installer writes to, so `jaw` can be

575// fine here and unresolvable there. doctor itself runs in the shell that

576// works, so it has to ask the question against `getconf PATH` instead of

577// process.env.PATH.

578if (process.platform !== 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/commands/doctor.jsView on unpkg · L565

579 check('Non-interactive PATH (ssh)', () => {

580 // Where jaw actually lives on THIS host. A version-managed Node

581 // (nvm/fnm/Homebrew) installs global bins under a prefix no static

582 // list can predict.

583 const npmPrefix = getNpmPrefix();

584 const knownBinDirs = [

585 npmPrefix ? path.join(npmPrefix, 'bin') : '',