Loading npm security reports…

grix-connector@4.11.1: AI-agent control-surface risk | LPM Firewall

registry / grix-connector / 4.11.1

grix-connector@4.11.1

Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The package installs a persistent helper automatically and includes an agent skill that fetches and overwrites skills from remotely supplied URLs. This creates a remote payload path into AI-agent control surfaces.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation followed by use of the bundled agent skill or a platform-supplied skill-package instruction.

Impact

An attacker controlling a supplied package URL can replace or add executable agent skills without meaningful user review.

Mechanism

Automatic persistence plus agent-directed remote skill installation.

Policy narrative

Installation runs a postinstall hook that persists executable guardian files under the user's Grix directory. The package also carries a Grix Egg skill that instructs an agent to accept a platform skill URL, download and unpack it, then copy every discovered skill into the agent's own skill directory while overwriting existing names. This is an unreviewed remote-code delivery mechanism aimed at AI-agent control surfaces.

AI rationale

The package contains an automatic install-time persistence action and a bundled skill that directs agents to install arbitrary remote skill packages over existing skills. The latter establishes a concrete remote payload path rather than ordinary connector configuration.

Evidence

package.jsonscripts/install-guardian.mjsdist/default-skills/grix-egg/SKILL.md~/.grix/bin/upgrade-guardian.mjs~/.grix/bin/upgrade-guardian.fallback.mjs~/.grix/bin/upgrade-guardian.sh

Source & flagged code

26 flagged

package.jsonView file

Lines 7-47json

7 "bin": {

8 "grix-connector": "dist/grix.js"

9 },

10 "files": [

11 "NOTICE",

12 "LICENSE",

13 "dist",

14 "!dist/**/*.map",

15 "!dist/**/*.d.ts",

16 "!dist/**/*.ts",

17 "openclaw-plugin",

18 "scripts/install-guardian.mjs",

19 "scripts/upgrade-guardian.mjs",

20 "scripts/launcher.mjs",

21 "scripts/analyze-audit-replays.mjs",

22 "scripts/install-guardian.sh",

23 "scripts/upgrade-guardian.sh",

24 "openclaw.plugin.json"

25 ],

26 "scripts": {

27 "postinstall": "node scripts/install-guardian.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

28 "prepublishOnly": "npm run build:all",

29 "build": "npm run check:isolation && node -e \"const fs=require('fs'); for(const dir of ['dist/default-skills','dist/kimi-plugins']) fs.rmSync(dir,{recursive:true,force:true})\" && tsc && node -e \"const fs=require('fs'); for(const dir of ['default-skills','kimi-plugins']) fs.cpSync('src/'+dir,'dist/'+dir,{recursive:true,filter:s=>!s.endsWith('.ts')}); fs.cpSync('src/adapter/deepseek-harness/grix-jsonrpc.cordis.yml','dist/adapter/deepseek-harness/grix-jsonrpc.cordis.yml')\" && node scripts/build-dsh-bridge.mjs && node -e \"require('fs').cpSync('src/core/proxy/hermes-profile-relay.py','dist ...

30 "check:isolation": "node scripts/check-adapter-isolation.mjs",

31 "build:plugin": "node scripts/build-plugin.mjs",

32 "build:all": "npm run build && node scripts/minify-dist.mjs && npm run build:plugin",

33 "dev": "npm run build && node dist/grix.js",

34 "test": "node --experimental-vm-modules node_modules/vitest/vitest.mjs run",

35 "test:watch": "node --experimental-vm-modules node_modules/vitest/vitest.mjs",

36 "test:e2e": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e",

37 "test:e2e:smoke": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/smoke.test.ts",

38 "test:e2e:direct-relay": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/direct-relay-live.test.ts",

39 "test:e2e:relay": "node scripts/relay-e2e.mjs",

40 "test:e2e:codex-developer-instructions": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-developer-instructions-protocol.test.ts",

41 "test:e2e:claude-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/claude-audit-replay.test.ts",

42 "test:e2e:codex-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/codex-audit-replay.test.ts",

43 "test:e2e:native-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts",

44 "test:e2e:kimi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/native-event-audit-replay.test.ts -t \"kimi:\"",

45 "test:e2e:kimi-question": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/kimi-acp-features.test.ts -t \"问答卡文本回执\"",

46 "test:e2e:pi-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/pi-audit-replay.test.ts",

47 "test:e2e:reasonix-audit": "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/reasonix-audit-replay.test.ts",

Long lines were clipped for display.

openclaw-plugin/index.jsView file

Lines 2292-2332javascript

2292 warn(tag, msg, ...args) {

2293 if (!shouldLog(tag, "warn")) return;

2294 const line = formatLine("warn"

dist/core/mcp/internal-api-server.jsView file

Lines 1-2javascript

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from

dist/core/proxy/crypto/certificate.jsView file

Lines 1-6javascript

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFile as

dist/core/upgrade/upgrade-checker.jsView file

Lines 1-4javascript

1import{closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be}from"node:fs";import{join as v,dirname as Se}

dist/core/provider-quota/kiro.jsView file

Lines 1-2javascript

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";

dist/core/installer/npm-registry.jsView file

Lines 1-5javascript

1import{execFile as b,execFileSync as C}from"node:child_process";import{existsSync as $,mkdirSync as k}from"node:fs";import{basename as O,dirname as x,join as y}from"node:path"

dist/adapter/codex/codex-bridge.jsView file

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js -> dist/adapter/codex/index.js -> dist/adapter/codex/codex-bridge.js L1: import{execFileSync as fe}from"node:child_process";import{createInterface as me}from"node:readline";import{EventEmitter as K}from"node:events";import{stat as Z}from"node:fs/promise... L2: \u2026(truncated)`,re=80,tt=120*1e3,it=60*1e3,st=300*1e3,nt=H("GRIX_CODEX_DELTA_COALESCE_MS",1e3),rt=H("GRIX_CODEX_DELTA_COALESCE_CHARS",4096),ot=[{id:"gpt-5.3-codex",displayName:"... L3: `)})}catch{return!1}}getStatus(){return{alive:this.alive,busy:this.currentTurnId!==null||this.compacting,sessions:this.threadId?1:0}}getActiveEventIds(){return this.activeEventId?[...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/codex/codex-bridge.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/codex/codex-bridge.jsView on unpkg

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgz kind = high_entropy_blob sizeBytes = 23388 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgz kind = compressed_blob sizeBytes = 23388 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgz kind = nested_archive_needs_inspection sizeBytes = 23388 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView on unpkg

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View on unpkg

dist/adapter/agy/quota.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/agy/quota.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/agy/quota.jsView on unpkg

dist/adapter/claude/mcp-http-launcher.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/claude/mcp-http-launcher.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/mcp-http-launcher.jsView on unpkg

dist/core/proxy/hermes-profile-relay.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/core/proxy/hermes-profile-relay.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/proxy/hermes-profile-relay.jsView on unpkg

dist/core/runtime/spawn.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/core/runtime/spawn.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/spawn.jsView on unpkg

dist/core/upgrade/npm-upgrader.jsView file

•matchType = token_shingles matchedPackage = grix-connector@4.6.3 matchedPath = dist/core/upgrade/npm[redacted] matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/upgrade/npm-upgrader.jsView on unpkg

dist/core/util/cli-probe.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/core/util/cli-probe.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/util/cli-probe.jsView on unpkg

dist/adapter/claude/model-list.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/claude/model-list.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/model-list.jsView on unpkg

dist/adapter/cursor/cursor-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/cursor/cursor-adapter.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/cursor/cursor-adapter.jsView on unpkg

dist/adapter/deepseek-harness/bridge-installer.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/deepseek-harness/bridge-installer.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/deepseek-harness/bridge-installer.jsView on unpkg

dist/adapter/deepseek-harness/profile-catalog.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = dist/adapter/deepseek-harness/profile-catalog.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/deepseek-harness/profile-catalog.jsView on unpkg

dist/adapter/openhuman/openhuman-adapter.jsView file

•matchType = normalized_sha256 matchedPackage = grix-connector@4.6.3 matchedPath = [redacted]-adapter.js matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:4.6.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/openhuman/openhuman-adapter.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-guardian.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

openclaw-plugin/index.jsView file

2312// src/audit/producer/ipc-audit-producer.ts L2313: import { fork } from "node:child_process"; L2314: import { randomUUID as randomUUID2 } from "node:crypto";

High

Child Process

Package source references child process execution.

openclaw-plugin/index.jsView on unpkg · L2312

3081} L3082: function buildExecApprovalResolveArgv(params) { L3083: const cliArgvPrefix = params.cliArgvPrefix && params.cliArgvPrefix.length > 0 ? params.cliArgvPrefix : resolveOpenClawCliArgvPrefix();

High

Shell

Package source references shell execution.

openclaw-plugin/index.jsView on unpkg · L3081

dist/core/mcp/internal-api-server.jsView file

1import B from"node:http";import{randomBytes as M}from"node:crypto";import{log as h}from"../log/index.js";import{PHASE1_INVOKE_ACTIONS as C,TOOLS as O,toolCallToInvoke as P}from"./t...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/mcp/internal-api-server.jsView on unpkg · L1

dist/core/proxy/crypto/certificate.jsView file

1import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFi... L2: `)??"";return`-----BEGIN ${e}-----

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/proxy/crypto/certificate.jsView on unpkg · L1

dist/core/upgrade/upgrade-checker.jsView file

1import{closeSync as H,existsSync as w,mkdirSync as F,openSync as we,readFileSync as P,realpathSync as ve,renameSync as ye,writeFileSync as be}from"node:fs";import{join as v,dirname... L2: --- ${o.to_version} crash note ---

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core/upgrade/upgrade-checker.jsView on unpkg · L1

dist/core/provider-quota/kiro.jsView file

1import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";import{execFile as I}from"node:c...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core/provider-quota/kiro.jsView on unpkg · L1

dist/core/installer/npm-registry.jsView file

1import{execFile as b,execFileSync as C}from"node:child_process";import{existsSync as $,mkdirSync as k}from"node:fs";import{basename as O,dirname as x,join as y}from"node:path";impo... L2: [${o.label}] ${a}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/core/installer/npm-registry.jsView on unpkg · L1

dist/adapter/codex/codex-bridge.jsView file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/adapter/codex/codex-bridge.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/codex/codex-bridge.jsView on unpkg

dist/core/proxy/hermes-profile-relay.pyView file

•path = dist/core/proxy/hermes-profile-relay.py kind = build_helper sizeBytes = 21893 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/core/proxy/hermes-profile-relay.pyView on unpkg

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView file

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgz kind = high_entropy_blob sizeBytes = 23388 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgz kind = compressed_blob sizeBytes = 23388 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView on unpkg

•path = dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgz kind = nested_archive_needs_inspection sizeBytes = 23388 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/dsh-bridge/grix-dsh-bridge-4.11.1.tgzView on unpkg

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapter/acp/acp-adapter.js#virtual:normalized:round1View on unpkg

dist/adapter/agy/quota.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/agy/quota.jsView on unpkg

dist/adapter/claude/mcp-http-launcher.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/mcp-http-launcher.jsView on unpkg

dist/core/proxy/hermes-profile-relay.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/proxy/hermes-profile-relay.jsView on unpkg

dist/core/runtime/spawn.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/runtime/spawn.jsView on unpkg

dist/core/upgrade/npm-upgrader.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/upgrade/npm-upgrader.jsView on unpkg

dist/core/util/cli-probe.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/util/cli-probe.jsView on unpkg

dist/adapter/claude/model-list.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/claude/model-list.jsView on unpkg

dist/adapter/cursor/cursor-adapter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/cursor/cursor-adapter.jsView on unpkg

dist/adapter/deepseek-harness/bridge-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/deepseek-harness/bridge-installer.jsView on unpkg

dist/adapter/deepseek-harness/profile-catalog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/deepseek-harness/profile-catalog.jsView on unpkg

dist/adapter/openhuman/openhuman-adapter.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapter/openhuman/openhuman-adapter.jsView on unpkg