emp-code@0.5.26
EMP CLI - coding agent with full-screen TUI (ink, clickable tool output, mouse, plan mode, markdown, vision) and 18 providers. Runs great on any light PC / weak CPU / old motherboard. Sessions, context, effort, web search, background tasks, revert.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis package exposes meaningful command-execution and conditional unverified-binary-download capability, but source inspection does not establish automatic malicious behavior. It warrants a warning as a dangerous coding-agent package rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Set EMP_EXE_URL during installation, or invoke the CLI and approve tool or MCP actions.
Impact
A supplied install environment URL can place an executable that the CLI later launches; runtime agent actions can modify the active workspace or run configured external tools.
Mechanism
Conditional executable download and user-directed command execution.
AI rationale
This package exposes meaningful command-execution and conditional unverified-binary-download capability, but source inspection does not establish automatic malicious behavior. It warrants a warning as a dangerous coding-agent package rather than a publish block.
Evidence
scripts/postinstall.jsbin/emp.jslib/tools.jslib/mcp.jsdist/emp-win.exedist/emp-macosdist/emp-linux.emp/mcp.json~/.emp/mcp.json
Network endpoints1
github.com/saintdevzz/emp-cli/releases/latest/download/
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook can download an executable from an environment-selected URL without integrity verification.
- The CLI runs a package-local executable when one is present.
- The agent can execute shell commands and start configured MCP server commands at runtime.
Evidence against
- The install hook exits unless EMP_EXE_URL is already set.
- There is no self-dependency or automatic mutation of another agent's control surface.
- Runtime tool operations include approval and path-safety checks.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
24 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/emp.jsView file
4try {
L5: const exeName = process.platform === 'win32' ? 'emp-win.exe' : process.platform === 'darwin' ? 'emp-macos' : 'emp-linux';
L6: const exePath = require('path').join(__dirname, '..', 'dist', exeName);
L7: if (require('fs').existsSync(exePath)) {
L8: const { spawn } = require('child_process');
L9: const child = spawn(exePath, process.argv.slice(2), { stdio: 'inherit' });
...
L31:
L32: const VERSION = require('../package.json').version;
L33: const versionMod = require('../lib/version');
...
L39: const msg = err && err.stack || err && err.message || String(err);
L40: try { process.stderr.write(`\n[emp: uncaught] ${msg}\n`); } catch {}
L41:
Findings
6 Critical15 High7 Medium6 Low
CriticalPersistence Backdoorbin/emp.js
CriticalDownload Executelib/tools.js
CriticalEncrypted Payload Temp Executionemp-web/dist/server.cjs
CriticalRemote Response Code Executionemp-web/dist/server.cjs
CriticalTrigger Reachable Dangerous Capabilitybin/emp.js
CriticalPrevious Version Dangerous Deltaemp-web/dist/server.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/emp.js
HighShelllib/tools.js
HighEval
HighSandbox Evasion Gated Capabilitybin/emp.js
HighRemote Agent Bridgebin/emp.js
Affected versions and remediation
This report applies to emp-code@0.5.26.
See all versions of emp-code for other recorded verdicts.
- Review the evidence and your use of emp-code@0.5.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.