Loading npm security reports…

cli-jaw@2.17.65: Suspicious npm security report (Warn) | LPM Firewall

registry / cli-jaw / 2.17.65

cli-jaw@2.17.65

Personal AI assistant powered by Pi, Antigravity, Claude, Codex, Codex App, Cursor, Grok, Kiro, OpenCode, and Copilot — Web, Terminal, Slack, Telegram, and Discord interfaces with 33 skills active by default from a 230-skill reference library

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Postinstall initializes cli-jaw home state and MCP configuration. MCP synchronization can update an existing Codex configuration, but the inspected source does not establish a confirmed attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs its postinstall hook; safe mode skips setup side effects.

Impact

The setup can affect agent configuration and therefore warrants a warning; no concrete malicious impact was established.

Mechanism

Postinstall creates package-owned files and initializes MCP configuration. Shared-path migration is opt-in, and optional CLI tool updates are skipped by default.

AI rationale

Source inspection found a postinstall lifecycle that initializes package-owned agent integrations, with an opt-in path for shared agent locations. This supports a warning for agent extension lifecycle risk, but not a publish block.

Evidence

package.jsondist/bin/postinstall.jsdist/lib/mcp/format-converters.js

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook invokes the package setup guard.

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-guard.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/bin/postinstall.jsView file

24import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, migrateAllJawHomes, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js';

High

Child Process

Package source references child process execution.

dist/bin/postinstall.jsView on unpkg · L24

5console.error(`[jaw:init] ❌ Node.js >= 22 required (current: ${process.version})`); L6: console.error(`[jaw:init] Install: https://nodejs.org or nvm install 22`); L7: process.exit(1); ... L24: import os from 'os'; L25: import { execFileSync } from 'child_process'; L26: import { ensureSharedHomeSkillsLinks, initMcpConfig, copyDefaultSkills, propagateSkillsToInstances, migrateAllJawHomes, loadUnifiedMcp, saveUnifiedMcp } from '../lib/mcp-sync.js'; ... L29: let execFileAdapter = execFileSync; L30: let toolPlatform = process.platform; L31: /** Test seam. Returns a restore function. Not for production use. */ ... L61: const JAW_HOME = (() => { L62: if (!process.env["CLI_JAW_HOME"]) L63: return path.join(os.homedir(), '.cli-jaw');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bin/postinstall.jsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/postinstall.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/postinstall.jsView on unpkg

dist/bin/commands/doctor.jsView file

110const installHint = process.platform === 'win32' L111: ? 'powershell -ExecutionPolicy Bypass -File "$(npm root -g)\\cli-jaw\\scripts\\install-officecli.ps1" -Update' L112: : 'bash "$(npm root -g)/cli-jaw/scripts/install-officecli.sh"';

High

Shell

Package source references shell execution.

dist/bin/commands/doctor.jsView on unpkg · L110

565const installHint = process.platform === 'win32' L566: ? 'powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"' L567: : 'curl -LsSf https://astral.sh/uv/install.sh | sh'; ... L576: // works, so it has to ask the question against `getconf PATH` instead of L577: // process.env.PATH. L578: if (process.platform !== 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/commands/doctor.jsView on unpkg · L565

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/doctor.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/doctor.jsView on unpkg

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView file

98// eslint-disable-next-line no-new-func -- vendored bundle injection on CSP-strict pages L99: new Function(src)(); L100: }, source);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/browser/adaptive-fetch/defuddle-extractor.jsView on unpkg · L98

dist/src/ide/diff.jsView file

7*/ L8: import { execFileSync, execFile } from 'node:child_process'; L9: import { writeFileSync, mkdtempSync, mkdirSync, statSync, realpathSync, rmSync, readFileSync } from 'node:fs'; ... L139: // Antigravity: 여러 env 시그널 확인 (VS Code 포크라서 VSCODE_* 도 공존) L140: if (process.env["ANTIGRAVITY_AGENT"] === '1') L141: return 'antigravity';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/ide/diff.jsView on unpkg · L7

dist/bin/commands/launchd.jsView file

9Trigger-reachable persistence chain: manifest.bin -> dist/bin/cli-jaw.js -> dist/bin/commands/launchd.js L9: */ L10: import { execSync } from 'node:child_process'; L11: import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from 'node:fs'; ... L16: import { asRecord, errString } from '../_http-client.js'; L17: if (process.argv[2] === 'launchd' && !process.env["_CLI_JAW_SERVICE_DELEGATE"]) { L18: console.error(' ⚠️ jaw launchd is deprecated. Use jaw service instead (cross-platform).'); ... L42: const LABEL = `com.cli-jaw.${INSTANCE}`; L43: const PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); L44: const LOG_DIR = join(JAW_HOME, 'logs'); ... L75: try { L76: execSync(`launchctl print ${GUI_DOMAIN}/${LABEL}`, { stdio: 'pipe' }); L77: return tru

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/bin/commands/launchd.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/launchd.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/launchd.jsView on unpkg

9*/ L10: import { execSync } from 'node:child_process'; L11: import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from 'node:fs'; ... L16: import { asRecord, errString } from '../_http-client.js'; L17: if (process.argv[2] === 'launchd' && !process.env["_CLI_JAW_SERVICE_DELEGATE"]) { L18: console.error(' ⚠️ jaw launchd is deprecated. Use jaw service instead (cross-platform).'); ... L42: const LABEL = `com.cli-jaw.${INSTANCE}`; L43: const PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`); L44: const LOG_DIR = join(JAW_HOME, 'logs'); ... L75: try { L76: execSync(`launchctl print ${GUI_DOMAIN}/${LABEL}`, { stdio: 'pipe' }); L77: return true;

dist/bin/commands/skill.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { readfilesync, writefilesync, existssync, mkdirsync, rmsync, cpsync } from 'node:fs'; import { join } from 'node:path'; import { homedir } from 'node:os'; import { execsync } from 'node:child_process'; import { jaw_home, skills_dir } from '../../src/core/config.js'; import { dedupeskilldirentries } from '../../lib/mcp/sk[redacted]'; import { resolveskillid, legacyskillidnotice } from '../../lib/mcp/sk[redacted]'; const codex_skills = join(homedir(), '.codex', 'skills'); const ref_dir = join(jaw_home, 'skills_ref'); const c = { reset: '\x1b[0m

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/bin/commands/skill.jsView on unpkg

public/dist/assets/MilkdownWysiwygEditor-xObhviw7.jsView file

142contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

public/dist/assets/MilkdownWysiwygEditor-xObhviw7.jsView on unpkg · L142

dist/bin/commands/mcp.jsView file

11* Package detection: L12: * npm: @scope/name or name → npm i -g <pkg> L13: * pypi: name (with --pypi flag) → uv tool install <pkg> / pip install <pkg> ... L15: */ L16: import { execSync, execFileSync } from 'node:child_process'; L17: import { readFileSync, existsSync, unlinkSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/commands/mcp.jsView on unpkg · L11

scripts/check-deps-online.shView file

•path = scripts/check-deps-online.sh kind = build_helper sizeBytes = 912 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/check-deps-online.shView on unpkg

dist/bin/commands/clone.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 26

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/commands/clone.js#virtual:normalized:round1View on unpkg

scripts/postinstall-guard.cjsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = scripts/postinstall-guard.cjs matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall-guard.cjsView on unpkg

dist/src/cli/capability-probe-worker.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/cli/capability-probe-worker.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/capability-probe-worker.jsView on unpkg

dist/src/routes/quota.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/routes/quota.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/routes/quota.jsView on unpkg

dist/bin/commands/chat.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/chat.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/chat.jsView on unpkg

dist/bin/commands/dashboard.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/bin/commands/dashboard.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/commands/dashboard.jsView on unpkg

dist/lib/mcp/skills-reset.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/lib/mcp/sk[redacted] matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/mcp/skills-reset.jsView on unpkg

dist/lib/quota-copilot.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/lib/quota-copilot.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/quota-copilot.jsView on unpkg

dist/src/agent/codex-app-client.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/agent/codex-app-client.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/agent/codex-app-client.jsView on unpkg

dist/src/cli/capability-probe.jsView file

•matchType = normalized_sha256 matchedPackage = cli-jaw@2.17.51 matchedPath = dist/src/cli/capability-probe.js matchedIdentity = npm:Y2xpLWphdw:2.17.51 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/cli/capability-probe.jsView on unpkg

Lines 139-179javascript

139 console.log(` ✅ ${name}: ${detail || 'OK'}`);

140 }

141 catch (e) {

142 const isWarn = e.message?.startsWith('WARN:');

143 const status = isWarn ? 'warn' : 'error';

144 const msg = e.message?.replace(/^WARN:\s*/, '') || 'unknown';

145 results.push({ name, status, detail: msg });

146 if (!values.json) {

147 console.log(` ${isWarn ? '⚠️ ' : '❌'} ${name}: ${msg}`);

148 }

149 }

150}

151function resolvePackageRoot() {

152 // Compiled location is dist/bin/commands/doctor.js, so walk up until the

153 // directory actually holding package.json (same fallback as bin/cli-jaw.ts).

154 let packageRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..');

155 if (!fs.existsSync(path.join(packageRoot, 'package.json'))) {

156 packageRoot = path.join(packageRoot, '..');

157 }

158 return packageRoot;

159}

160const require_ = createRequire(import.meta.url);

161const { listStaleStaging } = require_(path.join(resolvePackageRoot(), 'scripts', 'staging-cleanup.cjs'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/commands/doctor.jsView on unpkg · L159

162console.log(!values.json ? '\n 🦈 cli-jaw doctor\n' : '');

163// 1. Home directory

164check('Home directory', () => {

165 if (!fs.existsSync(JAW_HOME)) {

166 fs.mkdirSync(JAW_HOME, { recursive: true });

167 }

168 fs.accessSync(JAW_HOME, fs.constants.W_OK);

169 return JAW_HOME;

170});

171// 1b. Install scripts — npm >= 12 blocks unreviewed dependency lifecycle

172// scripts, so a "successful" global install may have skipped our postinstall.

173// The install-state receipt (or the jaw-init setup marker) tells them apart.

174check('Install scripts', () => {

175 const packageRoot = resolvePackageRoot();

176 const integrity = inspectInstallIntegrity(packageRoot, JAW_HOME);

177 if (integrity.installScriptState === 'completed') {

178 return integrity.userSetupDone ? 'ran (setup complete)' : 'ran';

179 }

Lines 545-585javascript

545 });

546 return 'granted';

547 }

548 catch {

549 // Auto-open System Preferences

550 try {

551 execSync('open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"', { stdio: 'pipe' });

552 }

553 catch { } // best-effort: opening System Preferences can fail on headless/CI

554 throw new Error('WARN: 접근성 권한 필요 → 시스템 설정을 열었습니다. Terminal을 추가해주세요');

555 }

556 });

557}

558// 9. Skill dependencies (Phase 9)

559check('uv (Python)', () => {

560 try {

561 const ver = execSync('uv --version', { encoding: 'utf8', stdio: 'pipe' }).trim();

562 return ver;

563 }

564 catch {

565 const installHint = process.platform === 'win32'

566 ? 'powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"'

567 : 'curl -LsSf https://astral.sh/uv/install.sh | sh';

568 throw new Error(`WARN: not installed — run: ${installHint}`);

569 }

570});

571// 9b. Non-interactive shell reachability (#479)

572//

573// Remote one-shot commands (`ssh host 'jaw serve ...'`) run a shell that

574// reads none of the profile files the installer writes to, so `jaw` can be

575// fine here and unresolvable there. doctor itself runs in the shell that

576// works, so it has to ask the question against `getconf PATH` instead of

577// process.env.PATH.

578if (process.platform !== 'win32') {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/commands/doctor.jsView on unpkg · L565

579 check('Non-interactive PATH (ssh)', () => {

580 // Where jaw actually lives on THIS host. A version-managed Node

581 // (nvm/fnm/Homebrew) installs global bins under a prefix no static

582 // list can predict.

583 const npmPrefix = getNpmPrefix();

584 const knownBinDirs = [

585 npmPrefix ? path.join(npmPrefix, 'bin') : '',