registry  /  dreamcontext  /  0.10.5

dreamcontext@0.10.5

dreamcontext — the persistent brain for your AI agents. Remembers what you built, knows how your project works.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No confirmed malicious attack surface. The real risk is explicit first-party AI-agent extension setup that mutates Claude/Codex config and hooks when the user runs dreamcontext setup or install-skill.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs install.sh, dreamcontext setup, dreamcontext install-skill, app install/update, or marketing/integration commands
Impact
Project AI-agent behavior can be modified by installed hooks/instructions; optional commands may contact GitHub, npm, Meta, or configured task services.
Mechanism
first-party agent extension installation and package-aligned CLI integrations
Rationale
Static inspection found explicit first-party agent-extension setup and broad CLI capabilities, but no npm lifecycle install-time hijack, credential exfiltration, stealth persistence, or remote payload execution chain. This fits a warning for agent extension lifecycle risk rather than a publish block.
Evidence
package.jsoninstall.shdist/index.jsskill/SKILL.mddist/templates/CLAUDE.mddist/templates/AGENTS.md.claude/settings.json.claude/skills/dreamcontext/SKILL.md.claude/agents/*.md.agents/skills/dreamcontext/SKILL.md.codex/config.toml.codex/agents/*.tomlCLAUDE.mdAGENTS.md_dream_context/state/.install-manifest.json~/Applications/dreamcontext-beta.app~/.dreamcontext/app.json
Network endpoints3
api.github.com/repos/meanllbrl/dreamcontext/releases/latestgraph.facebook.comgraph-video.facebook.com

Decision evidence

public snapshot
AI called this Suspicious at 82.0% confidence as Benign with medium false-positive risk.
Evidence for warning
  • dist/index.js installs first-party Claude/Codex skills, agents, root instructions, and hook config via explicit setup/install-skill commands
  • dist/index.js writes .claude/settings.json and .codex/config.toml hooks that run npx dreamcontext hook commands
  • install.sh one-line installer runs npm install -g dreamcontext@latest, optional app install, then dreamcontext setup/update
  • dist/index.js can fetch desktop app releases from https://api.github.com/repos/meanllbrl/dreamcontext/releases/latest and download release assets after sha256 check
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle; only prepublishOnly build
  • AI-agent control-surface writes are user-invoked CLI/setup behavior, not automatic npm install mutation
  • Hook commands appear package-aligned: snapshot/session state, context injection, tool gating, dashboard open
  • Tokens for ClickUp/GitHub/Meta are stored/read for configured integrations and masked/redacted; no source evidence of credential exfiltration
  • Meta/GitHub network code is tied to explicit user commands/integrations, with dry-run and auth safeguards
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
ManifestNo manifest risk signals triggered.
scanned 136 file(s), 9.83 MB of source, external domains: app.excalidraw.com, bellard.org, chevrotain.io, cli.github.com, discord.gg, docs.excalidraw.com, en.wikipedia.org, esm.sh, excalidraw-room-persistence.firebaseio.com, fb.me, feross.org, github.com, jcgt.org, jquery.org, json.excalidraw.com, langium.org, libraries.excalidraw.com, mermaid.js.org, oss-ai.excalidraw.com, oss-collab.excalidraw.com, player.vimeo.com, plus.excalidraw.com, react.dev, tldrlegal.com, twitter.com, us-central1-excalidraw-room-persistence.cloudfunctions.net, www.figma.com, www.npmjs.com, www.shadertoy.com, www.w3.org, www.youtube.com, x.com, youtube.com
Oversized source lightweight scan
dist/index.js2.79 MB file, sampled 256 KB
FilesystemChildProcessShellHighEntropyStringsUrlStringscli.github.comfeross.orggithub.com

Source & flagged code

11 flagged · loading source
dist/dashboard/assets/subset-shared.chunk-Bin8VoC6.jsView file
22patternName = aws_access_key severity = critical line = 22 matchedText = `,X.push...;/**
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/dashboard/assets/subset-shared.chunk-Bin8VoC6.jsView on unpkg · L22
22patternName = aws_access_key severity = critical line = 22 matchedText = `,X.push...;/**
Critical
Secret Pattern

AWS access key ID in dist/dashboard/assets/subset-shared.chunk-Bin8VoC6.js

dist/dashboard/assets/subset-shared.chunk-Bin8VoC6.jsView on unpkg · L22
dist/dashboard/assets/BrainCanvas3D-8hG96aAi.jsView file
4114is considered to be not a multigraph by default (each edge is unique).`),r.multigraph=r.uniqueLinkId),r.multigraph===void 0&&(r.multigraph=!1),typeof Map!="function")throw new Erro... L4115: `,l=Array(o+1).join(" "),c=[];for(let u=0;u<t;++u){let h=r(u),d=u===0?"":l;c.push(d+i.replace(/{var}/g,h))}return c.join(a)}},$d}var A_;function BC(){if(A_)return ea.exports;A_=1;c... L4116: ${i(s,o)}
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/dashboard/assets/BrainCanvas3D-8hG96aAi.jsView on unpkg · L4114
dist/skill-packs/excalidraw/examples/style_board.jsView file
2// Shows card/connector/sectionTitle + the dimension-aware lane() (captions hug images, .nextY stacks). L3: const path = require('path'); L4: const { buildExcalidraw, lane } = require(path.join(__dirname, '..', 'scripts', 'build_excalidraw.js'));
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/skill-packs/excalidraw/examples/style_board.jsView on unpkg · L2
dist/skill-packs/excalidraw/scripts/build_excalidraw.jsView file
8// - `%% ## Drawing ```json <scene> ``` %%` (uncompressed JSON; plugin reads it fine) L9: // Images need NO base64 — the fileId (sha1 of the file) + the Embedded Files wikilink is enough. L10: // ... L285: version: 2, L286: source: 'https://github.com/zsviczian/obsidian-excalidraw-plugin', L287: elements,
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/skill-packs/excalidraw/scripts/build_excalidraw.jsView on unpkg · L8
dist/dashboard/assets/percentages-BXMCSKIN-DckRvLSG.jsView file
108contains invisible/control Unicode U+202A (left-to-right embedding) */var Qg;function IF(){if(Qg)return vh;Qg=1;var e=S5(),t=MF();function n(d,l){return d===l&&(d!==0||1/d===1/l)||d!==d&&l!==l}var a=typeof Object.is=="function"?Object.is:n,i=t.useSyncExternalStore,r=e.useRef,s=e.useEffect,o=e.useMemo,c=e.u
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/dashboard/assets/percentages-BXMCSKIN-DckRvLSG.jsView on unpkg · L108
2patternName = google_api_key severity = high line = 2 matchedText = import{a...AZZX
High
Secret Pattern

Google API key in dist/dashboard/assets/percentages-BXMCSKIN-DckRvLSG.js

dist/dashboard/assets/percentages-BXMCSKIN-DckRvLSG.jsView on unpkg · L2
dist/skill-packs/video-watching/scripts/transcribe.shView file
•path = dist/skill-packs/video-watching/scripts/transcribe.sh kind = build_helper sizeBytes = 12857 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skill-packs/video-watching/scripts/transcribe.shView on unpkg
dist/dashboard/assets/Assistant-Bold-gm-uSS1B.woff2View file
•path = dist/dashboard/assets/Assistant-Bold-gm-uSS1B.woff2 kind = high_entropy_blob sizeBytes = 20380 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/dashboard/assets/Assistant-Bold-gm-uSS1B.woff2View on unpkg
dist/index.jsView file
•path = dist/index.js kind = oversized_source_file sizeBytes = 2929491 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg
•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 2929491 magicHex = [redacted]
Medium
Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Findings

3 Critical3 High6 Medium9 Low
CriticalCritical Secretdist/dashboard/assets/subset-shared.chunk-Bin8VoC6.js
CriticalTrojan Source Unicodedist/dashboard/assets/percentages-BXMCSKIN-DckRvLSG.js
CriticalSecret Patterndist/dashboard/assets/subset-shared.chunk-Bin8VoC6.js
HighShips High Entropy Blobdist/dashboard/assets/Assistant-Bold-gm-uSS1B.woff2
HighOversized Source Filedist/index.js
HighSecret Patterndist/dashboard/assets/percentages-BXMCSKIN-DckRvLSG.js
MediumDynamic Requiredist/skill-packs/excalidraw/examples/style_board.js
MediumNetwork
MediumProtestware
MediumShips Build Helperdist/skill-packs/video-watching/scripts/transcribe.sh
MediumOversized Cli Entrypointdist/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/dashboard/assets/BrainCanvas3D-8hG96aAi.js
LowWeak Cryptodist/skill-packs/excalidraw/scripts/build_excalidraw.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings