registry / AI-agent capability abuse / emp-code / 0.1.6

emp-code@0.1.6

EMP CLI - coding agent with full-screen TUI (ink, clickable tool output, mouse, plan mode, markdown, vision) and 18 providers. Runs great on any light PC / weak CPU / old motherboard. Sessions, context, effort, web search, background tasks, revert.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package has meaningful remote-agent and shell-execution capability, including an embedded default third-party provider. Static inspection found no automatic installation attack, hidden exfiltration routine, or persistence behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user starts an EMP chat with tools enabled and the model requests a tool.

Impact

A remote provider or compromised model can induce local commands or access workspace content; destructive commands normally require confirmation.

Mechanism

Remote-model-driven local agent tools.

AI rationale

Evidence

lib/providers.jslib/tools.jslib/config.js

Network endpoints1

hybra.onyx-2f0t.workers.dev

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The CLI sends conversations and tool definitions to remote model endpoints.
A remote model can invoke a shell-command tool.
The bundled default provider uses a third-party endpoint with an embedded default key.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Shell execution is reached through the interactive agent tool path, with confirmation for flagged destructive commands.
No source evidence shows hidden credential harvesting, install-time execution, or persistence.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 408 KB of source, external domains: aistudio.google.com, api.anthropic.com, api.b.ai, api.cerebras.ai, api.cohere.ai, api.example.com, api.groq.com, api.llm7.io, api.mistral.ai, api.openai.com, api.siliconflow.com, api.tokenrouter.com, api.true-sota.com, api.z.ai, b.ai, build.nvidia.com, console.anthropic.com, console.groq.com, console.mistral.ai, dashboard.cohere.com, discord.gg, dreamprompting.com, generativelanguage.googleapis.com, html.duckduckgo.com, huggingface.co, hybra.onyx-2f0t.workers.dev, inference.cerebras.ai, integrate.api.nvidia.com, opencode.ai, openrouter.ai, platform.openai.com, raw.githubusercontent.com, registry.npmjs.org, router.huggingface.co, routesme.online, s.wordpress.com, search.yahoo.com, siliconflow.com, tokenrouter.com, true-sota.com, z.ai

Source & flagged code

8 flagged

bin/emp.jsView file

1216try { L1217: const { spawn } = require('child_process'); L1218: const ps = `

High

Child Process

Package source references child process execution.

bin/emp.jsView on unpkg · L1216

846if (!id) { console.log(' cancelled'); return defaultId; } L847: const baseUrl = (await lifecycle.ask(' baseUrl (e.g. https://api.example.com): ')).trim(); L848: if (!/^https?:\/\//i.test(baseUrl)) { console.log(C.red + ' baseUrl must start with http(s)://' + C.r); return defaultId; } ... L1216: try { L1217: const { spawn } = require('child_process'); L1218: const ps = ` ... L1645: if (!fs.existsSync(abs)) { console.log(`File not found: ${abs}`); return; } L1646: const data = fs.readFileSync(abs); L1647: if (data.length > 8*1024*1024) { console.log(`Image too large ${(data.length/1024/1024).toFixed(1)}MB, max 8MB`); return; }

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/emp.jsView on unpkg · L846

3L4: const readline = require('readline'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/emp.jsView on unpkg · L3

lib/tools.jsView file

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L27: const p = []; L28: if (process.platform === 'win32') { L29: const w = (process.env.windir || 'C:\\Windows').toLowerCase();

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/tools.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> bin/emp.js -> lib/tools.js L4: const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L27: const p = []; L28: if (process.platform === 'win32') { L29: const w = (process.env.windir || 'C:\\Windows').toLowerCase();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/tools.jsView on unpkg · L4

178L179: try { require('child_process').execSync('where powershell', { stdio: 'ignore', windowsHide: true }); child = spawn(command, { cwd, windowsHide: true, shell: 'powershell.exe' }); } L180: catch { child = spawn(command, { cwd, windowsHide: true, shell: true }); }

High

Shell

Package source references shell execution.

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

lib/context.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/context.js#virtual:normalized:round1View on unpkg

Source & flagged code

8 flagged · loading source

bin/emp.jsView file

1216try { L1217: const { spawn } = require('child_process'); L1218: const ps = `

High

Child Process

Package source references child process execution.

bin/emp.jsView on unpkg · L1216

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/emp.jsView on unpkg · L846

3L4: const readline = require('readline'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/emp.jsView on unpkg · L3

Findings

2 Critical4 High5 Medium5 Low

CriticalDownload Executelib/tools.js

CriticalTrigger Reachable Dangerous Capabilitylib/tools.js

HighChild Processbin/emp.js

HighShelllib/tools.js

HighRemote Agent Bridgebin/emp.js

HighSemantic Analysis Limitedlib/context.js#virtual:normalized:round1

MediumDynamic Requirebin/emp.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Low

Affected versions and remediation

This report applies to emp-code@0.1.6.

See all versions of emp-code for other recorded verdicts.

Review the evidence and your use of emp-code@0.1.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-31 05:31:57.634Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code