emp-code@0.1.4
EMP CLI - coding agent with full-screen TUI (ink, clickable tool output, mouse, plan mode, markdown, vision) and 18 providers. Runs great on any light PC / weak CPU / old motherboard. Sessions, context, effort, web search, background tasks, revert.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no install-time hook or concealed payload, so the source does not establish malware. However, automatic execution of workspace-controlled MCP commands is a critical RCE vulnerability.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs emp chat in a workspace containing .emp/mcp.json.
Impact
Arbitrary code can run as the user and receive inherited environment variables.
Mechanism
Automatic spawning of workspace-configured MCP servers with inherited environment variables.
AI rationale
The package has no install-time hook or concealed payload, so the source does not establish malware. However, automatic execution of workspace-controlled MCP commands is a critical RCE vulnerability.
Evidence
bin/emp.jslib/mcp.js.emp/mcp.json
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- Starting the chat interface automatically loads and connects every MCP server configured in the current workspace.
- A workspace-controlled MCP configuration supplies the executable, arguments, working directory, and inherited environment to a spawned process without a consent check.
- The default chat provider is an opaque Cloudflare Workers endpoint with a bundled default key, so chat content is sent there unless the user changes provider.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The risky MCP path requires the user to start the CLI in a workspace containing .emp/mcp.json.
- Normal model-requested destructive tools have an approval path.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcebin/emp.jsView file
1192try {
L1193: const { spawn } = require('child_process');
L1194: const ps = `
High
829if (!id) { console.log(' cancelled'); return defaultId; }
L830: const baseUrl = (await lifecycle.ask(' baseUrl (e.g. https://api.example.com): ')).trim();
L831: if (!/^https?:\/\//i.test(baseUrl)) { console.log(C.red + ' baseUrl must start with http(s)://' + C.r); return defaultId; }
...
L1192: try {
L1193: const { spawn } = require('child_process');
L1194: const ps = `
...
L1621: if (!fs.existsSync(abs)) { console.log(`File not found: ${abs}`); return; }
L1622: const data = fs.readFileSync(abs);
L1623: if (data.length > 8*1024*1024) { console.log(`Image too large ${(data.length/1024/1024).toFixed(1)}MB, max 8MB`); return; }
High
Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
bin/emp.jsView on unpkg · L8293L4: const readline = require('readline');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/emp.jsView on unpkg · L3Findings
2 Critical4 High5 Medium5 Low
CriticalDownload Executelib/tools.js
CriticalTrigger Reachable Dangerous Capabilitylib/tools.js
HighChild Processbin/emp.js
HighShelllib/tools.js
HighRemote Agent Bridgebin/emp.js
HighSemantic Analysis Limitedlib/context.js#virtual:normalized:round1
MediumDynamic Requirebin/emp.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to emp-code@0.1.4.
See all versions of emp-code for other recorded verdicts.
- Review the evidence and your use of emp-code@0.1.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.