registry / freddie / 0.0.132

freddie@0.0.132

Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established by source inspection. The package is an agent harness with powerful runtime tools, but inspected shell, messaging, Home Assistant, crypto, and plugin-loading behavior are package-aligned and user-invoked.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs freddie CLI/dashboard/agent tool actions

Impact

Expected agent capabilities may execute commands or call configured services when invoked; no unconsented install-time mutation, exfiltration, or remote payload execution found.

Mechanism

Runtime plugin-discovered agent tools and provider/platform integrations

Rationale

Scanner findings map to expected runtime agent/tool capabilities: shell execution, env-gated service APIs, provider calls, and plugin discovery. There is no lifecycle hook, stealth persistence, credential exfiltration, or unconsented AI-agent control-surface mutation in the inspected source.

Evidence

package.jsonbin/freddie.jssrc/index.jssrc/host/index.jssrc/host/host.jsplugins/bash/handler.jsplugins/homeassistant_tool/handler.jsplugins/send_message/handler.jsplugins/platform-wecom_crypto/handler.js~/.freddie/projects.json~/.freddie/auth/*~/.freddie/plugins/*<cwd>/.freddie/plugins/*

Network endpoints8

homeassistant.local:8123api.x.ai/v1/chat/completionsopen.feishu.cn/open-apisslack.com/apidiscord.com/api/v10graph.facebook.com/v20.0api.twilio.com/2010-04-01qyapi.weixin.qq.com/cgi-bin/webhook/send

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with medium false-positive risk.

Evidence for block

plugins/bash/handler.js exposes a user-invoked shell tool with process.env passed through
src/host/index.js discovers plugins from package, ~/.freddie/plugins, and cwd .freddie/plugins at CLI/runtime
plugins/send_message/handler.js dynamically imports fixed gateway adapter paths based on a schema enum

Evidence against

package.json has no preinstall/install/postinstall/prepare lifecycle hooks
bin/freddie.js only boots plugin host and registers CLI commands; no install-time or import-time payload observed
plugins/homeassistant_tool/handler.js sends HASS_TOKEN only to HASS_URL/default Home Assistant API for explicit state/service actions
plugins/platform-wecom_crypto/handler.js contains WeCom signature/decrypt helpers, not credential harvesting
Network calls found are provider/platform/tool aligned and gated by explicit tool/CLI/runtime use

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 420 file(s), 545 KB of source, external domains: 127.0.0.1, api.byterover.com, api.hindsightai.com, api.honcho.dev, api.hunyuan.cloud.tencent.com, api.mem0.ai, api.moonshot.ai, api.moonshot.cn, api.nousresearch.com, api.openviking.com, api.osv.dev, api.retaindb.com, api.sgroup.qq.com, api.spotify.com, api.supermemory.ai, api.telegram.org, api.twilio.com, api.vercel.com, api.weixin.qq.com, api.x.ai, api.z.ai, app.daytona.io, cloudcode-pa.googleapis.com, discord.com, graph.facebook.com, homeassistant.local, html.duckduckgo.com, models.dev, oapi.dingtalk.com, oauth2.googleapis.com, open.bigmodel.cn, open.feishu.cn, openrouter.ai, qyapi.weixin.qq.com, raw.githubusercontent.com, serpapi.com, slack.com, www.apple.com, www.googleapis.com

Source & flagged code

4 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

16 schema: { name: 'send_message', description: 'Send a message to a recipient on the named platform. Uses the gateway adapter; requires the platform credentials.', parameters: { type: 'object', properties: { platform: { type: 'string', enum: Object.keys(PLATFORM_MODULES) }, to: { type: 'string' }, text: { type: 'string' } }, required: ['platform', 'to', 'text'] } },

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',

4 schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['state', 'service'] }, entity_id: { type: 'string' }, domain: { type: 'string' }, service: { type:

plugins/bash/handler.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = freddie@0.0.125 matchedIdentity = npm:ZnJlZGRpZQ:0.0.125 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/bash/handler.jsView on unpkg

Source & flagged code

4 flagged · loading source

plugins/send_message/handler.jsView file

19if (!mod) return { error: 'unknown platform: ' + platform } L20: const m = await import(mod) L21: const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

plugins/platform-wecom_crypto/handler.jsView file

6export function decryptMsg(encryptedB64, encodingAesKey) { L7: const aesKey = Buffer.from(encodingAesKey + '=', 'base64') L8: const iv = aesKey.slice(0, 16)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/platform-wecom_crypto/handler.jsView on unpkg · L6

plugins/homeassistant_tool/handler.jsView file

3toolset: 'core', L4: schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['... L5: requiresEnv: ['HASS_TOKEN', 'HASS_URL'], L6: checkFn: () => Boolean(process.env.HASS_TOKEN), L7: handler: async ({ action, entity_id, domain, service, data = {} }) => { L8: const url = process.env.HASS_URL || 'http://homeassistant.local:8123' L9: const auth = { authorization: `Bearer ${process.env.HASS_TOKEN}` } L10: if (action === 'state') return await (await fetch(`${url}/api/states/${entity_id}`, { headers: auth })).json() L11: if (action === 'service') return await (await fetch(`${url}/api/services/${domain}/${service}`, { method: 'POST', headers: { ...auth, 'content-type': 'application/json' }, body: JS...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

plugins/homeassistant_tool/handler.jsView on unpkg · L3

plugins/bash/handler.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/bash/handler.jsView on unpkg

Findings

2 Critical4 Medium5 Low

CriticalCredential Exfiltrationplugins/homeassistant_tool/handler.js

CriticalPrevious Version Dangerous Deltaplugins/bash/handler.js

MediumDynamic Requireplugins/send_message/handler.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoplugins/platform-wecom_crypto/handler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',

plugins/bash/handler.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

plugins/bash/handler.jsView on unpkg