registry  /  grindeasy  /  0.3.3

grindeasy@0.3.3

Discord Rich Presence + personal tiers for AI coding tools (Claude Code, Codex, OpenCode). Shows what you're actively coding with, tracks your tier, and (Phase 2) feeds a global leaderboard.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The CLI can install a per-user background tracker that starts at login and restarts after exits. This is explicit/interactive first-party persistence, not install-time execution or a foreign AI-agent control-surface mutation.

Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User runs `grindeasy service install`, or accepts the interactive post-pairing service prompt.
Impact
Creates self-persistence for the tracker and, after user pairing, uploads aggregate activity totals to the package's configured server.
Mechanism
Per-user OS service registration and optional leaderboard sync.
Rationale
The package implements potentially unwanted persistence but gates it behind an explicit command or interactive prompt and keeps it scoped to its own tracker. No concrete malicious chain was found by static source inspection.
Evidence
package.jsondist/index.jsdist/service.jsdist/config.jsdist/sync.jsdist/fsScan.jsdist/tools.js~/.config/systemd/user/grindeasy.service~/Library/LaunchAgents/tech.grindeasy.plist~/.grindeasy/supervise.vbs~/.grindeasy/config.json~/.grindeasy/stats.json
Network endpoints2
grindeasy.tech127.0.0.1:${statsPort}/api/stats

Decision evidence

public snapshot
AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `dist/service.js` writes per-user boot-persistent service artifacts.
  • Linux/macOS/Windows registration invokes `systemctl`, `launchctl`, or `reg add`.
  • Windows artifact is a hidden VBS loop that restarts `grindeasy` indefinitely.
  • `dist/index.js` offers background installation after leaderboard pairing, defaulting to yes.
Evidence against
  • `package.json` has no install, postinstall, or preinstall hook.
  • Service setup is reached by `grindeasy service install` or an interactive prompt, not installation.
  • `dist/sync.js` sends only aggregate tool totals, plan, combos, and agent version after opt-in pairing.
  • `dist/fsScan.js` reads only metadata timestamps, not AI-tool file contents.
  • No dynamic code loading, eval, shell interpolation, credential harvesting, or remote payload execution found.
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 15 file(s), 65.0 KB of source, external domains: 127.0.0.1, discord.com, github.com, grindeasy.tech, www.apple.com, www.buymeacoffee.com

Source & flagged code

2 flagged · loading source
dist/service.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = grindeasy@0.3.1 matchedIdentity = npm:Z3JpbmRlYXN5:0.3.1 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/service.jsView on unpkg
1import { execFile } from "node:child_process"; L2: import { spawn } from "node:child_process"; ... L26: */ L27: const LOGIN_SHELL = "/bin/bash"; L28: const LOGIN_SHELL_ARGS = ["-lc", "exec grindeasy"]; ... L136: if (platform === "darwin") { L137: return [["launchctl", "bootstrap", `gui/${uid()}`, launchdPlistPath(home)]]; L138: } ... L181: const defaultRunner = (cmd, args) => new Promise((resolve) => { L182: execFile(cmd, args, { windowsHide: true }, (err, stdout, stderr) => { L183: const code = err && typeof err.code === "number" ... L205: return {
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/service.jsView on unpkg · L1

Findings

1 High3 Medium5 Low
HighPrevious Version Dangerous Deltadist/service.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/service.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings