registry / Remote code execution / emp-code / 0.5.18

emp-code@0.5.18

EMP CLI - coding agent with full-screen TUI (ink, clickable tool output, mouse, plan mode, markdown, vision) and 18 providers. Runs great on any light PC / weak CPU / old motherboard. Sessions, context, effort, web search, background tasks, revert.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package contains a concrete, network-reachable remote command-execution vulnerability in its user-invoked web mode. Its install hook is gated by an explicit environment variable, so the evidence does not establish malicious install-time behavior.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the emp web command.

Impact

A reachable attacker can cause command execution in the EMP process context and access its workspace and inherited environment.

Mechanism

Unauthenticated network-exposed command and agent-control interface.

AI rationale

Evidence

emp-web/server.cjslib/mcp.jsbin/emp.js.emp/mcp.json

Network endpoints1

0.0.0.0

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The web command starts an unauthenticated HTTP service on every network interface.
The web service enables automatic approval by default, allowing model-requested tools to bypass ordinary confirmations.
A remote caller can add an MCP command and immediately reload it; configured MCP commands are spawned with the process environment.
This creates a network-reachable path to command execution and access to the configured workspace when the user runs the web command.

Evidence against

The npm postinstall exits unless the user explicitly supplies EMP_EXE_URL.
No self-dependency or automatic broad AI-agent configuration mutation was found.
Provider requests are consistent with the package's stated coding-agent functionality.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinified

Source & flagged code

23 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emp.jsView file

4try { L5: const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L31: L32: const VERSION = require('../package.json').version; L33: const versionMod = require('../lib/version'); ... L39: const msg = err && err.stack || err && err.message || String(err); L40: try { process.stderr.write(`\n[emp: uncaught] ${msg}\n`); } catch {} L41:

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/emp.jsView on unpkg · L4

4Trigger-reachable chain: scripts.start -> bin/emp.js L4: try { L5: const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L31: L32: const VERSION = require('../package.json').version; L33: const versionMod = require('../lib/version'); ... L39: const msg = err && err.stack || err && err.message || String(err); L40: try { process.stderr.write(`\n[emp: uncaught] ${msg}\n`); } catch {} L41:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/emp.jsView on unpkg · L4

7if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' });

High

Child Process

Package source references child process execution.

bin/emp.jsView on unpkg · L7

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/emp.jsView on unpkg · L4

7if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L1037: if (!id) { console.log(' cancelled'); return defaultId; } L1038: const baseUrl = (await lifecycle.ask(' baseUrl (e.g. https://api.example.com): ')).trim(); L1039: if (!/^https?:\/\//i.test(baseUrl)) { console.log(C.red + ' baseUrl must start with http(s)://' + C.r); return defaultId; } ... L1682: const schemas = tools.getSchemas(); L1683: console.log('Available tools:'); L1684: for (const t of schemas) { ... L1896: if (!fs.existsSync(abs)) { console.log(`File not found: ${abs}`); return; } L1897: const data = fs.readFileSync(abs); L1898: if (data.length > 8*1024*1024) { console.log(`Image too large ${(data.

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

bin/emp.jsView on unpkg · L7

4Detached bundled service listener: bin/emp.js spawns emp-web/dist/server.cjs; helper exposes a broad-bound HTTP listener. L4: try { L5: const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L31: L32: const VERSION = require('../package.json').version; L33: const versionMod = require('../lib/version'); ... L39: const msg = err && err.stack || err && err.message || String(err); L40: try { process.stderr.write(`\n[emp: uncaught] ${msg}\n`); } catch {} L41:

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/emp.jsView on unpkg · L4

4Trigger-reachable persistence chain: scripts.start -> bin/emp.js L4: try { L5: const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) { L8: const { spawn } = require('child_process'); L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' }); ... L31: L32: const VERSION = require('../package.json').version; L33: const versionMod = require('../lib/version'); ... L39: const msg = err && err.stack || err && err.message || String(err); L40: try { process.stderr.write(`\n[emp: uncaught] ${msg}\n`); } catch {} L41:

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/emp.jsView on unpkg · L4

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/emp.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = bin/emp.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/emp.jsView on unpkg

5const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux'; L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName); L7: if (require('fs').existsSync(exePath)) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/emp.jsView on unpkg · L5

lib/tools.jsView file

4const path = require('path'); L5: const { spawn } = require('child_process'); L6: const bg = require('./bg'); L7: let workspace; L8: try { workspace = require('./workspace'); } catch { workspace = { getWorkspace: () => process.cwd() }; } L9: ... L15: L16: function unrestricted() { return process.env.EMP_UNRESTRICTED === '1'; } L17: ... L62: function hasUnresolvedShortName(abs) { L63: if (process.platform !== 'win32') return false; L64: return String(abs || '').split(/[\\/]+/).some((seg) => /~\d+$/.test(seg));

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/tools.jsView on unpkg · L4

High

Shell

Package source references shell execution.

lib/tools.jsView on unpkg · L296

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = lib/tools.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/tools.jsView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1217 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

lib/tui.jsView file

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = lib/tui.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/tui.jsView on unpkg

emp-web/server.cjsView file

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = emp-web/server.cjs matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

emp-web/server.cjsView on unpkg

lib/diagnostics.jsView file

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = lib/diagnostics.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/diagnostics.jsView on unpkg

lib/mcp.jsView file

•matchType = token_shingles matchedPackage = emp-code@0.5.8 matchedPath = lib/mcp.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/mcp.jsView on unpkg

scripts/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = scripts/postinstall.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

lib/config.jsView file

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = lib/config.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/config.jsView on unpkg

lib/providers.jsView file

•matchType = normalized_sha256 matchedPackage = emp-code@0.5.8 matchedPath = lib/providers.js matchedIdentity = npm:ZW1wLWNvZGU:0.5.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/providers.jsView on unpkg

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/emp.jsView file

Findings

3 Critical17 High6 Medium6 Low

CriticalPersistence Backdoorbin/emp.js

CriticalDownload Executelib/tools.js

CriticalTrigger Reachable Dangerous Capabilitybin/emp.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/emp.js

HighShelllib/tools.js

HighSandbox Evasion Gated Capabilitybin/emp.js

HighRemote Agent Bridgebin/emp.js

HighSpawned Bundled Service Listenerbin/emp.js

HighTrigger Reachable Persistencebin/emp.js

HighSemantic Analysis Limitedbin/emp.js

HighKnown Malware Source Similaritybin/emp.js

Affected versions and remediation

This report applies to emp-code@0.5.18.

See all versions of emp-code for other recorded verdicts.

Review the evidence and your use of emp-code@0.5.18 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-05 00:07:24.335Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code