registry / impel-cli / 0.14.0

impel-cli@0.14.0

Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `impel use`, `impel agents sync`, `impel mcp`, `impel claude`, `impel codex`, or app-management commands.

Impact

Can alter selected AI-client configuration and expose user-initiated MCP requests to the configured gateway; this is a real agent-control capability but is not covert malware behavior.

Mechanism

User-invoked AI-client configuration, authenticated gateway proxying, and managed agent-profile writes.

Rationale

No concrete malicious chain was found, but the package deliberately changes AI-agent client control surfaces and proxies authenticated requests after explicit commands. Per policy, this warrants a warning rather than a block.

Evidence

package.jsonbin/impel.jssrc/claudeSetup.jssrc/codexSetup.jssrc/agents.jssrc/commands/mcp.jssrc/apps.jssrc/updates.js~/.config/impel/config.json~/.claude/settings.json~/.claude.json~/.codex/config.toml

Network endpoints5

gateway.useimpel.comwww.useimpel.comregistry.npmjs.orgdownloads.claude.aipersistent.oaistatic.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/claudeSetup.js` can merge an Impel API helper, gateway URL, and `impel` MCP entry into native Claude configuration.
`src/agents.js` fetches an authenticated tenant agent catalog and writes managed Claude/Codex agent profiles.
`src/commands/mcp.js` proxies JSON-RPC with the configured tenant bearer credential to `<gateway>/mcp`.
`src/apps.js` downloads, modifies, signs, and launches isolated vendor desktop-app wrappers after explicit app commands.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or other lifecycle hook.
`bin/impel.js` only dispatches the user-invoked CLI; there is no import-time execution path.
Network requests target configured Impel services and npm update metadata, not hidden third-party endpoints.
The inspected process launches use explicit CLI/platform-tool paths; no eval, VM execution, or remote payload loader was found.
Credential/config writes use owner-only modes and managed profile roots, with symlink checks in agent/Codex helpers.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 38 file(s), 402 KB of source, external domains: apps.microsoft.com, claude.com, downloads.claude.ai, gateway.useimpel.ai, gateway.useimpel.com, persistent.oaistatic.com, registry.npmjs.org, www.apple.com, www.useimpel.com

Source & flagged code

5 flagged

src/codesign.jsView file

Lines 6-46javascript

6// stable identity: its requirement degenerates to the binary's own cdhash,

7// which changes on every rebuild. So each time `impel app update` re-signed a

8// rebuilt bundle, macOS saw a brand-new app and re-prompted for every

9// permission the user had already granted.

10//

11// Signing rebuilds with a stable per-machine self-signed certificate instead

12// gives the bundle a constant designated requirement, so TCC grants survive

13// updates the way they do for a normal app. The certificate lives in a

14// dedicated keychain under the Impel config dir; no Apple Developer account is

15// involved (these bundles are patched and built on the user's own machine, so

16// Developer ID signing is impossible anyway).

17//

18// Everything here is best-effort: if any step fails — no `security`/`openssl`,

19// a locked keychain, an unusual environment — we fall back to ad-hoc signing,

20// which is exactly today's behavior. Updates never fail because signing could

21// not be upgraded.

23import fs from "node:fs";

24import os from "node:os";

25import path from "node:path";

26import crypto from "node:crypto";

27import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

src/codesign.jsView on unpkg · L26

29import { CONFIG_DIR } from "./config.js";

31export const SIGNING_IDENTITY_NAME = "Impel Local Codesigning";

33// Ad-hoc: what every managed bundle was signed with before stable identities.

34export const ADHOC_IDENTITY = Object.freeze({

35 mode: "adhoc",

36 signArg: "-",

37 keychainArgs: Object.freeze([]),

38 descriptor: "adhoc",

39});

41/** `codesign` arguments that select the given identity (and its keychain). */

42export function codesignIdentityArgs(identity = ADHOC_IDENTITY) {

43 return [...identity.keychainArgs, "--sign", identity.signArg];

44}

46/**

src/commands/update.jsView file

Lines 190-230javascript

190 if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });

191

192 console.log(`impel-cli v${current ?? "?"}`);

193 console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);

src/apps.jsView file

Lines 1627-1667javascript

1627printf 'at-%s\\n' "$TOKEN" | "$CODEX_BIN" login --with-access-token >/dev/null 2>&1

1628unset TOKEN

1629secure_codex_home

1630BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}

1631

src/updates.jsView file

Lines 1-31javascript

1// Update discovery shared by `impel update`, launch-time notices, and the

2// app-triggered background refresh.

3//

4// impel-cli is distributed as a public npm package. The package contains only

5// the same dependency-free JavaScript users run locally; access to Impel is

6// still enforced by PAT verification and live product/tenant authorization at

7// the control plane and gateway. Update checks therefore use npm's public

8// registry metadata and never require access to the private source repository.

10import fs from "node:fs";

src/gateway/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = impel-cli@0.13.2 matchedIdentity = npm:aW1wZWwtY2xp:0.13.2 similarity = 0.973 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gateway/index.jsView on unpkg

Source & flagged code

5 flagged · loading source

src/codesign.jsView file

26import crypto from "node:crypto"; L27: import { spawnSync } from "node:child_process"; L28:

High

Child Process

Package source references child process execution.

src/codesign.jsView on unpkg · L26

src/commands/update.jsView file

210if (io.platform === "win32") { L211: console.error(" Verify `npm --version` in PowerShell, then retry `impel update`."); L212: console.error(" Manual recovery: `npm install --global impel-cli@latest`.");

High

Shell

Package source references shell execution.

src/commands/update.jsView on unpkg · L210

src/apps.jsView file

1647if (process.type === "browser" && displayName) { L1648: const Module = require("node:module"); L1649: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/apps.jsView on unpkg · L1647

src/updates.jsView file

11import path from "node:path"; L12: import { spawn } from "node:child_process"; L13: import { fileURLToPath } from "node:url"; ... L21: const DEFAULT_UPDATE_PACKAGE = "impel-cli"; L22: const DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org"; L23: const VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u; ... L25: export function updatePackage() { L26: return process.env.IMPEL_UPDATE_PACKAGE || DEFAULT_UPDATE_PACKAGE; L27: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/updates.jsView on unpkg · L11

src/gateway/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gateway/index.jsView on unpkg

Findings

4 High3 Medium5 Low

HighChild Processsrc/codesign.js

HighShellsrc/commands/update.js

HighSame File Env Network Executionsrc/updates.js

HighPrevious Version Dangerous Deltasrc/gateway/index.js

MediumDynamic Requiresrc/apps.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

src/codesign.jsView file

Lines 6-46javascript

6// stable identity: its requirement degenerates to the binary's own cdhash,

7// which changes on every rebuild. So each time `impel app update` re-signed a

8// rebuilt bundle, macOS saw a brand-new app and re-prompted for every

9// permission the user had already granted.

10//

11// Signing rebuilds with a stable per-machine self-signed certificate instead

12// gives the bundle a constant designated requirement, so TCC grants survive

13// updates the way they do for a normal app. The certificate lives in a

14// dedicated keychain under the Impel config dir; no Apple Developer account is

15// involved (these bundles are patched and built on the user's own machine, so

16// Developer ID signing is impossible anyway).

17//

18// Everything here is best-effort: if any step fails — no `security`/`openssl`,

19// a locked keychain, an unusual environment — we fall back to ad-hoc signing,

20// which is exactly today's behavior. Updates never fail because signing could

21// not be upgraded.

23import fs from "node:fs";

24import os from "node:os";

25import path from "node:path";

26import crypto from "node:crypto";

27import { spawnSync } from "node:child_process";

High

Child Process

Package source references child process execution.

src/codesign.jsView on unpkg · L26

29import { CONFIG_DIR } from "./config.js";

31export const SIGNING_IDENTITY_NAME = "Impel Local Codesigning";

33// Ad-hoc: what every managed bundle was signed with before stable identities.

34export const ADHOC_IDENTITY = Object.freeze({

35 mode: "adhoc",

36 signArg: "-",

37 keychainArgs: Object.freeze([]),

38 descriptor: "adhoc",

39});

41/** `codesign` arguments that select the given identity (and its keychain). */

42export function codesignIdentityArgs(identity = ADHOC_IDENTITY) {

43 return [...identity.keychainArgs, "--sign", identity.signArg];

44}

46/**

src/commands/update.jsView file

Lines 190-230javascript

190 if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });

191

192 console.log(`impel-cli v${current ?? "?"}`);

193 console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);

src/apps.jsView file

Lines 1627-1667javascript

1627printf 'at-%s\\n' "$TOKEN" | "$CODEX_BIN" login --with-access-token >/dev/null 2>&1

1628unset TOKEN

1629secure_codex_home

1630BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}

1631

src/updates.jsView file

Lines 1-31javascript

1// Update discovery shared by `impel update`, launch-time notices, and the

2// app-triggered background refresh.

3//

4// impel-cli is distributed as a public npm package. The package contains only

5// the same dependency-free JavaScript users run locally; access to Impel is

6// still enforced by PAT verification and live product/tenant authorization at

7// the control plane and gateway. Update checks therefore use npm's public

8// registry metadata and never require access to the private source repository.

10import fs from "node:fs";

src/gateway/index.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/gateway/index.jsView on unpkg