Loading npm security reports…

engine7@7.1.56: Suspicious npm security report (Warn) | LPM Firewall

registry / engine7 / 7.1.56

engine7@7.1.56

Engine 7 — 给助手一个家 / A home for your AI assistant

AI Security Review

scanned 22d ago · by lpm-firewall-ai

When the engine is started with an AI model, the model can invoke a shell-backed command tool. An enabled private WeChat tool also passes tool input into a shell command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run engine7 start with a configuration that exposes these tools to an AI session.

Impact

A prompt-influenced model could run commands with the engine user's permissions; the private tool's command construction increases injection risk.

Mechanism

AI-mediated shell command execution.

AI rationale

No install-time attack chain or confirmed fixed exfiltration endpoint was found, so blocking as malware is not supported. The reachable shell execution features nevertheless warrant a warning for an AI-agent runtime.

Evidence

dist/engine-startup.mjs

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The runtime registers an AI-facing exec tool that runs supplied commands through a shell.
A private WeChat query tool builds a shell command from tool input and invokes it, while referring to a hard-coded developer-machine script path.

Source & flagged code

16 flagged · loading source

dist/engine-startup.mjsView file

3845READ_TIMEOUT_MS = 6e4; L3846: FIRST_READ_TIMEOUT_MS = parseInt(process.env.API_TIMEOUT_MS || "", 10) || 6e5; L3847: proxyAgentCache = /* @__PURE__ */ new Map(); ... L3858: }); L3859: import { spawn as spawn2 } from "child_process"; L3860: import net from "net"; L3861: import path6 from "path";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/engine-startup.mjsView on unpkg · L3845

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/engine-startup.mjsView on unpkg · L265

•matchType = previous_version_dangerous_delta matchedPackage = engine7@7.1.83 matchedIdentity = npm:ZW5naW5lNw:7.1.83 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/engine-startup.mjsView on unpkg

369// src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/engine-startup.mjsView on unpkg · L369

3630filesystem: true, L3631: shell: true, L3632: memory: true,

High

Shell

Package source references shell execution.

dist/engine-startup.mjsView on unpkg · L3630

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/engine-startup.mjsView on unpkg · L265

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine-startup.mjsView on unpkg · L265

dist/cli.mjsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.mjs: feishu: "https://accounts.feishu.cn", lark: "https://accounts.larksuite.com" fs.writeFileSync(fp, JSON.stringify({ sync_buf: buf })); if (redirectHost) currentBaseUrl = `https://${redirectHost}`; fs.writeFileSync(credFile, JSON.stringify({ accountId, token, baseUrl, userId }, null, 2), "utf8"); ILINK_BASE_URL = "https://ilinkai.weixin.qq.com"; WEIXIN_CDN_BASE_URL = "https://novac2c.cdn.weixin.qq.com/c2c"; fs.writeFileSync(this.filePath, JSON.stringify(obj));

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.mjsView on unpkg

23Cross-file remote execution chain: dist/cli.mjs spawns dist/main.mjs; helper contains network access plus dynamic code execution. L23: const url = `${ACCOUNTS_URL[domain]}${REGISTRATION_PATH}`; L24: const res = await fetch(url, { L25: method: "POST", L26: headers: { "Content-Type": "application/x-www-form-urlencoded" }, L27: body: new URLSearchParams(body).toString(), L28: signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) ... L30: if (!res.ok) { L31: throw new Error(`\u98DE\u4E66\u6CE8\u518C\u63A5\u53E3\u8FD4\u56DE ${res.status}: ${await res.text()}`); L32: } ... L176: import * as os from "os"; L177: import { promises as dns } from "dns"; L178: function sleep2(ms) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L23

23Trigger-reachable persistence chain: manifest.bin -> bin/engine7 -> dist/cli.mjs L23: const url = `${ACCOUNTS_URL[domain]}${REGISTRATION_PATH}`; L24: const res = await fetch(url, { L25: method: "POST", L26: headers: { "Content-Type": "application/x-www-form-urlencoded" }, L27: body: new URLSearchParams(body).toString(), L28: signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) ... L30: if (!res.ok) { L31: throw new Error(`\u98DE\u4E66\u6CE8\u518C\u63A5\u53E3\u8FD4\u56DE ${res.status}: ${await res.text()}`); L32: } ... L176: import * as os from "os"; L177: import { promises as dns } from "dns"; L178: function sleep2(ms) {

dist/main.mjsView file

99Trigger-reachable chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs48.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/main.mjsView on unpkg · L99

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: fs48.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", "utf-8"); fs4.writeFileSync(dumpPath, [systemStable, systemDynamic].join("\n\n"), "utf-8"); fs4.writeFileSync(path3.join(opts.workspace, ".context-debug.txt"), lines.join("\n") + "\n", "utf-8"); if (process.env.CLAUDE_CODE_MAX_RETRIES) { return parseInt(process.env.CLAUDE_CODE_MAX_RETRIES, 10); fs14.writeFileSync(outputPath, "", "utf-8"); import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs"; import { mkdir, readFile, rm, writeFile } from "node:fs/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg

99Trigger-reachable credential exfiltration chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs48.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

bin/engine7.cmdView file

•path = bin/engine7.cmd kind = build_helper sizeBytes = 42 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/engine7.cmdView on unpkg

templates/skills/superpowers/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @cliphijack/santaclaude@1.0.122 matchedPath = bundled-superpowers/skills/writing-skills/render-graphs.js matchedIdentity = npm:QGNsaXBoaWphY2svc2FudGFjbGF1ZGU:1.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/skills/superpowers/writing-skills/render-graphs.jsView on unpkg

Source & flagged code

16 flagged

dist/engine-startup.mjsView file

3845READ_TIMEOUT_MS = 6e4; L3846: FIRST_READ_TIMEOUT_MS = parseInt(process.env.API_TIMEOUT_MS || "", 10) || 6e5; L3847: proxyAgentCache = /* @__PURE__ */ new Map(); ... L3858: }); L3859: import { spawn as spawn2 } from "child_process"; L3860: import net from "net"; L3861: import path6 from "path";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/engine-startup.mjsView on unpkg · L3845

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/engine-startup.mjsView on unpkg · L265

•matchType = previous_version_dangerous_delta matchedPackage = engine7@7.1.83 matchedIdentity = npm:ZW5naW5lNw:7.1.83 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/engine-startup.mjsView on unpkg

369// src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/engine-startup.mjsView on unpkg · L369

3630filesystem: true, L3631: shell: true, L3632: memory: true,

High

Shell

Package source references shell execution.

dist/engine-startup.mjsView on unpkg · L3630

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/engine-startup.mjsView on unpkg · L265

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine-startup.mjsView on unpkg · L265

dist/cli.mjsView file

Lines 3-43javascript

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[

dist/main.mjsView file

99Trigger-reachable chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs48.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/main.mjsView on unpkg · L99

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: fs48.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", "utf-8"); fs4.writeFileSync(dumpPath, [systemStable, systemDynamic].join("\n\n"), "utf-8"); fs4.writeFileSync(path3.join(opts.workspace, ".context-debug.txt"), lines.join("\n") + "\n", "utf-8"); if (process.env.CLAUDE_CODE_MAX_RETRIES) { return parseInt(process.env.CLAUDE_CODE_MAX_RETRIES, 10); fs14.writeFileSync(outputPath, "", "utf-8"); import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs"; import { mkdir, readFile, rm, writeFile } from "node:fs/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg

99Trigger-reachable credential exfiltration chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs48.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

bin/engine7.cmdView file

•path = bin/engine7.cmd kind = build_helper sizeBytes = 42 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/engine7.cmdView on unpkg

templates/skills/superpowers/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @cliphijack/santaclaude@1.0.122 matchedPath = bundled-superpowers/skills/writing-skills/render-graphs.js matchedIdentity = npm:QGNsaXBoaWphY2svc2FudGFjbGF1ZGU:1.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/skills/superpowers/writing-skills/render-graphs.jsView on unpkg