registry / freddie / 0.0.139

freddie@0.0.139

Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time attack surface. The package is an agent harness whose shell, messaging, and integration capabilities activate through its CLI/runtime tools and configured credentials.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the `freddie` CLI or enables/invokes an agent tool or local plugin.

Impact

Authorized runtime actions may include shell execution, outbound messaging, and Home Assistant API calls; no covert package-originated attack chain is established.

Mechanism

Explicit plugin-based agent tooling and configured service integrations.

Rationale

Static source inspection confirms a feature-rich agent framework, not malware. Scanner hits map to explicit, package-aligned tools and configured integrations; no lifecycle execution or concrete unconsented malicious behavior was found.

Evidence

package.jsonbin/freddie.jssrc/host/host.jssrc/toolsets.jsplugins/terminal/handler.jsplugins/send_message/handler.jsplugins/homeassistant_tool/handler.jsplugins/platform-wecom_crypto/handler.jsplugins/gm-skill/plugin.jssrc/cli/uninstall.js

Network endpoints1

homeassistant.local:8123

Decision evidence

public snapshot

AI called this Clean at 89.0% confidence as Benign with low false-positive risk.

Evidence for block

`src/host/host.js` dynamically imports discovered `plugin.js` modules when the CLI/runtime boots.
`plugins/terminal/handler.js` exposes a core tool that spawns a shell after an agent/user invokes it.
`plugins/homeassistant_tool/handler.js` sends its configured `HASS_TOKEN` only to the user-configured Home Assistant URL.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, `prepare`, or uninstall lifecycle script.
`bin/freddie.js` only boots the plugin host and dispatches explicit CLI commands.
`plugins/send_message/handler.js` has a fixed allowlist of package gateway adapters and imports only the selected adapter.
No inspected source shows automatic credential harvesting, covert exfiltration, remote payload download, or foreign AI-agent configuration writes.
`src/cli/uninstall.js` only removes the package's own Freddie home directory when explicitly called with data removal enabled.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 418 file(s), 532 KB of source, external domains: 127.0.0.1, api.byterover.com, api.hindsightai.com, api.honcho.dev, api.hunyuan.cloud.tencent.com, api.mem0.ai, api.moonshot.ai, api.moonshot.cn, api.nousresearch.com, api.openviking.com, api.osv.dev, api.retaindb.com, api.sgroup.qq.com, api.spotify.com, api.supermemory.ai, api.telegram.org, api.twilio.com, api.vercel.com, api.weixin.qq.com, api.x.ai, api.z.ai, app.daytona.io, cloudcode-pa.googleapis.com, discord.com, graph.facebook.com, homeassistant.local, html.duckduckgo.com, models.dev, oapi.dingtalk.com, oauth2.googleapis.com, open.bigmodel.cn, open.feishu.cn, openrouter.ai, qyapi.weixin.qq.com, raw.githubusercontent.com, serpapi.com, slack.com, www.apple.com, www.googleapis.com

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

16 schema: { name: 'send_message', description: 'Send a message to a recipient on the named platform. Uses the gateway adapter; requires the platform credentials.', parameters: { type: 'object', properties: { platform: { type: 'string', enum: Object.keys(PLATFORM_MODULES) }, to: { type: 'string' }, text: { type: 'string' } }, required: ['platform', 'to', 'text'] } },

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',

4 schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['state', 'service'] }, entity_id: { type: 'string' }, domain: { type: 'string' }, service: { type:

Source & flagged code

3 flagged · loading source

plugins/send_message/handler.jsView file

19if (!mod) return { error: 'unknown platform: ' + platform } L20: const m = await import(mod) L21: const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

plugins/platform-wecom_crypto/handler.jsView file

6export function decryptMsg(encryptedB64, encodingAesKey) { L7: const aesKey = Buffer.from(encodingAesKey + '=', 'base64') L8: const iv = aesKey.slice(0, 16)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

plugins/platform-wecom_crypto/handler.jsView on unpkg · L6

plugins/homeassistant_tool/handler.jsView file

3toolset: 'core', L4: schema: { name: 'homeassistant_tool', description: 'Read state or call a service on Home Assistant.', parameters: { type: 'object', properties: { action: { type: 'string', enum: ['... L5: requiresEnv: ['HASS_TOKEN', 'HASS_URL'], L6: checkFn: () => Boolean(process.env.HASS_TOKEN), L7: handler: async ({ action, entity_id, domain, service, data = {} }) => { L8: const url = process.env.HASS_URL || 'http://homeassistant.local:8123' L9: const auth = { authorization: `Bearer ${process.env.HASS_TOKEN}` } L10: if (action === 'state') return await (await fetch(`${url}/api/states/${entity_id}`, { headers: auth })).json() L11: if (action === 'service') return await (await fetch(`${url}/api/services/${domain}/${service}`, { method: 'POST', headers: { ...auth, 'content-type': 'application/json' }, body: JS...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

plugins/homeassistant_tool/handler.jsView on unpkg · L3

Findings

1 Critical4 Medium5 Low

CriticalCredential Exfiltrationplugins/homeassistant_tool/handler.js

MediumDynamic Requireplugins/send_message/handler.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoplugins/platform-wecom_crypto/handler.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

plugins/send_message/handler.jsView file

Lines 1-31javascript

1const PLATFORM_MODULES = {

2 telegram: '../gateway/platforms/telegram.js',

3 discord: '../gateway/platforms/discord.js',

4 slack: '../gateway/platforms/slack.js',

5 whatsapp: '../gateway/platforms/whatsapp.js',

6 email: '../gateway/platforms/email.js',

7 sms: '../gateway/platforms/sms.js',

8 matrix: '../gateway/platforms/matrix.js',

9 signal: '../gateway/platforms/signal.js',

10 mattermost: '../gateway/platforms/mattermost.js',

11}

13export const _tool = ({

14 name: 'send_message',

15 toolset: 'core',

17 handler: async ({ platform, to, text }) => {

18 const mod = PLATFORM_MODULES[platform]

19 if (!mod) return { error: 'unknown platform: ' + platform }

20 const m = await import(mod)

21 const cls = Object.values(m)[0]

Medium

Dynamic Require

Package source references dynamic require/import behavior.

plugins/send_message/handler.jsView on unpkg · L19

22 const inst = new cls({})

23 try { await inst.start() } catch (e) { return { error: String(e.message || e) } }

24 try {

25 const out = await inst.send({ to, text })

26 await inst.stop?.()

27 return { ok: true, response: out }

28 } catch (e) { await inst.stop?.(); return { error: String(e.message || e) } }

29 },

30})

plugins/platform-wecom_crypto/handler.jsView file

Lines 1-17javascript

1import crypto from 'node:crypto'

2export function sha1(...parts) { return crypto.createHash('sha1').update(parts.sort().join('')).digest('hex') }

3export function

plugins/homeassistant_tool/handler.jsView file

Lines 1-15javascript

1export const _tool = ({

2 name: 'homeassistant_tool',

3 toolset: 'core',