AI Security Review
scanned 20h ago · by lpm-firewall-aiLPM treats this as warn-only first-party agent extension lifecycle risk. Unconsented npm lifecycle setup installs a package-owned CELL extension into ~/.cell. This is powerful agent-extension lifecycle behavior, but source evidence keeps it inside the package-declared first-party namespace.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
npm install of fcell2@1.0.12
Impact
Warn users that install-time setup changes CELL agent behavior and enables powerful runtime tools, without treating it as confirmed malware.
Mechanism
first-party agent extension lifecycle setup
Rationale
Policy repair: this package performs unconsented lifecycle setup of a powerful agent extension, but the write targets its own declared ~/.cell application namespace and no foreign agent-control hijack, exfiltration, remote payload, or permission bypass was found. Treat as warn-level first-party agent extension lifecycle risk, not publish-block malware.
Evidence
package.json.pi/extensions/fivo.tsdist/cli.jsdist/index.js~/.cell/agent/extensions/fivo.ts~/.cell/extensions/fivo.ts~/.cell/memory.json~/.cell/memory.db~/.cell/vault.json~/.cell/vibe.md~/.cell/mode.json~/.cell/agent/settings.json
Network endpoints1
api.openai.com/v1/embeddings
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall creates ~/.cell/agent/extensions and copies .pi/extensions/fivo.ts there during npm install
- postinstall removes legacy ~/.cell/extensions/fivo.ts if present
- fivo.ts registers CELL commands/providers/hooks and can enable read/bash/edit/write tools in CELL runtime
Evidence against
- package.json declares piConfig.configDir .cell and the lifecycle write stays inside that first-party namespace
- No install-time network fetch, credential exfiltration, remote payload loader, or foreign Claude/Codex/Cursor/MCP control-surface mutation was found
- fivo.ts network use is runtime embedding API configured from user vault, not install-time exfiltration
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "const{cpSync,mkdirSync,rmSync,existsSync}=require('fs');const{join}=require('path');const{homedir}=require('os');const d=join(homedir(),'.cell','agent','extensions');mkdir...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgexamples/extensions/doom-overlay/doom-engine.tsView file
64const nativeRequire = createRequire(doomJsPath);
L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);
L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);
Low
Eval
Package source references a known benign dynamic code generation pattern.
examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64dist/core/extensions/loader.jsView file
52};
L53: const require = createRequire(import.meta.url);
L54: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/core/extensions/loader.jsView on unpkg · L52examples/extensions/doom-overlay/doom/build/doom.wasmView file
•path = examples/extensions/doom-overlay/doom/build/doom.wasm
kind = wasm_module
sizeBytes = 380169
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkgexamples/extensions/doom-overlay/doom/build.shView file
•path = examples/extensions/doom-overlay/doom/build.sh
kind = build_helper
sizeBytes = 3366
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
examples/extensions/doom-overlay/doom/build.shView on unpkgdist/modes/interactive/interactive-mode.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = fcell2@1.0.8
matchedIdentity = npm:ZmNlbGwy:1.0.8
similarity = 0.992
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/modes/interactive/interactive-mode.jsView on unpkgFindings
2 Critical1 High6 Medium6 Low
CriticalRed Install Lifecycle Scriptpackage.json
CriticalPrevious Version Dangerous Deltadist/modes/interactive/interactive-mode.js
HighInstall Time Lifecycle Scriptspackage.json
MediumDynamic Requiredist/core/extensions/loader.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm
MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalexamples/extensions/doom-overlay/doom-engine.ts
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings