registry  /  fcell2  /  0.0.6

fcell2@0.0.6

Coding agent CLI with read, bash, edit, write tools and session management

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Install-time lifecycle code installs a bundled extension into the user's home .cell extension directory. The extension adds memory, vault, prompt-injection, mode, and slash-command behavior inside the package's apparent first-party agent platform.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm install of fcell2@0.0.6
Impact
User receives package-provided agent extension behavior without an explicit post-install CLI opt-in, but no confirmed foreign control-surface hijack or exfiltration was found.
Mechanism
postinstall extension drop into home-directory agent namespace
Policy narrative
During npm install, package.json postinstall creates ~/.cell/extensions and copies the bundled .pi/extensions/fivo.ts into it. That extension registers agent lifecycle hooks, local memory/vault commands, mode changes, and prompt-prefix construction from ~/.cell and local AGENTS.md/CLAUDE.md. The target namespace appears first-party for this CLI, and inspected code did not show network exfiltration, remote payload loading, or writes to foreign agent configs.
Rationale
The confirmed behavior is unprompted lifecycle installation of a package-supplied agent extension into a home-directory first-party namespace, which is warn-level agent extension lifecycle risk under the policy. I did not find source evidence of malicious exfiltration, destructive behavior, persistence outside the platform contract, or foreign/broad AI-agent control hijack.
Evidence
package.json.pi/extensions/fivo.tsdist/cli.jsdist/index.jsdist/core/extensions/loader.js~/.cell/extensions/fivo.ts~/.cell/memory.json~/.cell/vault.json~/.cell/vibe.md~/.cell/mode.json~/.cell/themes/cell-orange.json

Decision evidence

public snapshot
AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • package.json postinstall runs automatically on npm install
  • postinstall creates ~/.cell/extensions and copies .pi/extensions/fivo.ts there
  • Bundled fivo.ts registers extension hooks and slash commands for the agent runtime
  • fivo.ts reads/writes ~/.cell memory/vault/mode/theme files and can inject local AGENTS.md/CLAUDE.md into prompts
Evidence against
  • Lifecycle hook does not fetch remote code or contact a network endpoint
  • No credential exfiltration found; vault values stay local and are displayed masked
  • Mutation target is ~/.cell, matching package piConfig configDir and CLI namespace
  • No Claude/Codex/Cursor/MCP config write found in inspected install path
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 263 file(s), 2.30 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, distro.ibiblio.org, getcell.dev, git-scm.com, github.com, gitlab.com, mariozechner.at, mistral.ai

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node -e "const{cpSync,mkdirSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','extensions');mkdirSync(d,{recursive:true});c...
Critical
Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg
•scripts.postinstall = node -e "const{cpSync,mkdirSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','extensions');mkdirSync(d,{recursive:true});c...
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
examples/extensions/doom-overlay/doom-engine.tsView file
64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);
Low
Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64
dist/core/extensions/loader.jsView file
52}; L53: const require = createRequire(import.meta.url); L54: /**
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L52
examples/extensions/doom-overlay/doom/build/doom.wasmView file
•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg
examples/extensions/doom-overlay/doom/build.shView file
•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

Findings

1 Critical1 High6 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm
MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalexamples/extensions/doom-overlay/doom-engine.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings