dorkos: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

dorkos: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/bin/cli.js` implements `dorkos harness sync --fix`, which can project `.agents/` content into agent-harness files.
The projection code can write, symlink, remove, and merge managed hooks in the current project.
`dist/bin/cli.js` posts consent-gated telemetry to `https://dorkos.ai/api/telemetry/events`.
`core-extensions/linear-issues/server.ts` sends a configured Linear API key only to Linear's GraphQL endpoint when its disabled-by-default extension is enabled.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
Harness mutations require the explicit `dorkos harness sync --fix` command; normal sync reports drift.
The only child-process calls locate/check Claude or launch the user-selected editor; no shell payload execution was found.
Telemetry error reporting checks explicit config consent and supports environment kill switches.
Core extensions are package-owned and the Linear extension is `defaultEnabled: false`; no credential harvesting or foreign-agent mutation occurs at install time.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 193 file(s), 12.0 MB of source, external domains: 127.0.0.1, api.linear.app, cdn.jsdelivr.net, claude.ai, docs.anthropic.com, dorkos.ai, github.com, prosemirror.net, react.dev, reactflow.dev, registry.npmjs.org, www.apache.org, www.eclipse.org, www.gstatic.com, www.w3.org

Oversized source lightweight scan

dist/bin/cli.js3.42 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsclaude.aidocs.anthropic.comdorkos.airegistry.npmjs.org

dist/client/assets/index-C4KthfFg.js2.83 MB file, sampled 256 KB

FilesystemNetworkChildProcessDynamicRequireHighEntropyStringsMinifiedUrlStringsdorkos.aireact.dev

dist/client/assets/index-CZYN4Ank.js2.83 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

6 flagged · loading source

dist/client/assets/Model3dViewer-BjoTpua-.jsView file

4909* limitations under the License. L4910: */const CB=.04,Or=20,MB=/\.hdr(\.js)?$/,IB=/\.ktx2(\?|#|$)/;class Og{constructor(e){this.threeRenderer=e,this.lottieLoaderUrl="",this._ldrLoader=null,this._imageLoader=null,this._h... L4911:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/Model3dViewer-BjoTpua-.jsView on unpkg · L4909

dist/client/notification.wavView file

•path = dist/client/notification.wav kind = high_entropy_blob sizeBytes = 22094 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/notification.wavView on unpkg

dist/bin/cli.jsView file

•path = dist/bin/cli.js kind = oversized_source_file sizeBytes = 3587232 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin/cli.jsView on unpkg

•path = dist/bin/cli.js kind = oversized_cli_entrypoint sizeBytes = 3587232 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/cli.jsView on unpkg

dist/client/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.14 matchedPath = dist-renderer/assets/sql-D0XecflT.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/sql-D0XecflT.jsView on unpkg

dist/client/assets/vbscript-BuJXcnF6.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.14 matchedPath = dist-renderer/assets/vbscript-BuJXcnF6.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/vbscript-BuJXcnF6.jsView on unpkg

Source & flagged code

6 flagged

dist/client/assets/Model3dViewer-BjoTpua-.jsView file

4909* limitations under the License. L4910: */const CB=.04,Or=20,MB=/\.hdr(\.js)?$/,IB=/\.ktx2(\?|#|$)/;class Og{constructor(e){this.threeRenderer=e,this.lottieLoaderUrl="",this._ldrLoader=null,this._imageLoader=null,this._h... L4911:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/Model3dViewer-BjoTpua-.jsView on unpkg · L4909

dist/client/notification.wavView file

•path = dist/client/notification.wav kind = high_entropy_blob sizeBytes = 22094 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/notification.wavView on unpkg

dist/bin/cli.jsView file

•path = dist/bin/cli.js kind = oversized_source_file sizeBytes = 3587232 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bin/cli.jsView on unpkg

•path = dist/bin/cli.js kind = oversized_cli_entrypoint sizeBytes = 3587232 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/cli.jsView on unpkg

dist/client/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.14 matchedPath = dist-renderer/assets/sql-D0XecflT.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/sql-D0XecflT.jsView on unpkg

dist/client/assets/vbscript-BuJXcnF6.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.14 matchedPath = dist-renderer/assets/vbscript-BuJXcnF6.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/vbscript-BuJXcnF6.jsView on unpkg