Loading npm security reports…

engine7@7.1.67: Suspicious npm security report (Warn) | LPM Firewall

registry / engine7 / 7.1.67

engine7@7.1.67

Engine 7 — 给助手一个家 / A home for your AI assistant

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Network, filesystem, and shell capabilities are invoked only through the package's explicit agent and utility commands.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user must run the CLI, start the engine, or separately execute a bundled template utility.

Impact

No unconsented install-time execution, credential exfiltration, or foreign control-surface mutation was found.

Mechanism

User-configured AI-agent runtime and standalone local utilities.

AI rationale

Static findings stem from an explicitly operated AI-agent engine and bundled utility templates. Source inspection found no install hook, secret-forwarding endpoint, or automatic malicious execution path.

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.

Evidence for AI clean decision

The manifest exposes a CLI and start command but no automatic install lifecycle hook.
The runtime sends model requests only to a configured provider URL, defaulting to Anthropic's API.

Source & flagged code

17 flagged · loading source

dist/engine-startup.mjsView file

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/engine-startup.mjsView on unpkg · L265

369// src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/engine-startup.mjsView on unpkg · L369

3618filesystem: true, L3619: shell: true, L3620: memory: true,

High

Shell

Package source references shell execution.

dist/engine-startup.mjsView on unpkg · L3618

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/engine-startup.mjsView on unpkg · L265

265try { L266: const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8")); L267: loadHooksFromConfig(raw); ... L369: // src/hooks/executor.ts L370: import { spawn } from "child_process"; L371: import { randomUUID } from "node:crypto"; L372: function parseHookOutput(stdout) { L373: const trimmed = stdout.trim(); ... L450: const envVars = { L451: ...process.env, L452: CLAUDE_PROJECT_DIR: ctx.workspace ... L454: const command = hook.command;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/engine-startup.mjsView on unpkg · L265

dist/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = engine7@7.1.55 matchedIdentity = npm:ZW5naW5lNw:7.1.55 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli.mjs: feishu: "https://accounts.feishu.cn", lark: "https://accounts.larksuite.com" fs.writeFileSync(fp, JSON.stringify({ sync_buf: buf })); if (redirectHost) currentBaseUrl = `https://${redirectHost}`; fs.writeFileSync(credFile, JSON.stringify({ accountId, token, baseUrl, userId }, null, 2), "utf8"); ILINK_BASE_URL = "https://ilinkai.weixin.qq.com"; WEIXIN_CDN_BASE_URL = "https://novac2c.cdn.weixin.qq.com/c2c"; fs.writeFileSync(this.filePath, JSON.stringify(obj));

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli.mjsView on unpkg

48Cross-file remote execution chain: dist/cli.mjs spawns dist/main.mjs; helper contains network access plus dynamic code execution. L48: const url = `${ACCOUNTS_URL[domain]}${REGISTRATION_PATH}`; L49: const res = await fetch(url, { L50: method: "POST", L51: headers: { "Content-Type": "application/x-www-form-urlencoded" }, L52: body: new URLSearchParams(body).toString(), L53: signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) ... L55: if (!res.ok) { L56: throw new Error(`\u98DE\u4E66\u6CE8\u518C\u63A5\u53E3\u8FD4\u56DE ${res.status}: ${await res.text()}`); L57: } ... L201: import * as os from "os"; L202: import { promises as dns } from "dns"; L203: function sleep2(ms) {

dist/main.mjsView file

99Trigger-reachable chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs46.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/main.mjsView on unpkg · L99

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/main.mjs: fs46.writeFileSync(cfgPath, JSON.stringify(raw, null, 2) + "\n", "utf-8"); fs4.writeFileSync(dumpPath, [systemStable, systemDynamic].join("\n\n"), "utf-8"); fs4.writeFileSync(path3.join(opts.workspace, ".context-debug.txt"), lines.join("\n") + "\n", "utf-8"); if (process.env.CLAUDE_CODE_MAX_RETRIES) { return parseInt(process.env.CLAUDE_CODE_MAX_RETRIES, 10); let base = (this.config.baseUrl || "").trim(); "Authorization": `Bearer ${this.config.apiKey}` let u = (config2.baseUrl || "https://api.anthropic.com").trim();

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/main.mjsView on unpkg

99Trigger-reachable credential exfiltration chain: scripts.start -> dist/main.mjs L99: try { L100: const raw = JSON.parse(fs46.readFileSync(cfgPath, "utf-8")); L101: const keys = dotPath.split("."); ... L136: filesystem: true, L137: shell: true, L138: memory: true, ... L496: import { randomUUID } from "node:crypto"; L497: function parseHookOutput(stdout) { L498: const trimmed = stdout.trim(); ... L575: const envVars = { L576: ...process.env, L577: CLAUDE_PROJECT_DIR: ctx.workspace

bin/engine7.cmdView file

•path = bin/engine7.cmd kind = build_helper sizeBytes = 42 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/engine7.cmdView on unpkg

templates/skills/superpowers/brainstorming/scripts/server.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

templates/skills/superpowers/brainstorming/scripts/server.cjs#virtual:normalized:round1View on unpkg

templates/skills/superpowers/brainstorming/scripts/server.cjsView file

•matchType = normalized_sha256 matchedPackage = @brainervirus/workit-opencode@0.8.5 matchedPath = [redacted].cjs matchedIdentity = npm:[redacted]:0.8.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/skills/superpowers/brainstorming/scripts/server.cjsView on unpkg

templates/skills/superpowers/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @abblor/agent-os@0.11.0 matchedPath = skills/writing-skills/render-graphs.js matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

templates/skills/superpowers/writing-skills/render-graphs.jsView on unpkg