Loading npm security reports…

johns-harness@2026.9.8: Malicious npm security report (Block) | LPM Firewall

registry / johns-harness / 2026.9.8

johns-harness@2026.9.8

John's Harness: a production agent harness that runs autonomous coding agents as one cooperative swarm.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package executes a postinstall script that overwrites files in resolved installed dependencies and alters mr-memory. This silently changes the consumer's dependency tree.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

The package can replace trusted dependency behavior before the user runs the application.

Mechanism

Automatic mutation of installed dependency code.

Attack narrative

On installation, npm invokes the bundled postinstall script. The script recursively enumerates files under vendor/patched-deps, resolves each installed dependency, and copies the bundled files onto the installed versions. It then edits mr-memory's entry file and obscures the replaced product name through concatenated strings. These automatic, broad modifications occur without a user command and replace code in the consumer's installed dependency tree.

AI rationale

The package uses an automatic lifecycle hook to silently replace code in multiple installed dependencies and modify another dependency. This is concrete install-hook abuse despite the absence of an install-time network request in the inspected script.

Evidence

package.jsonscripts/postinstall.mjsvendor/patched-deps/@mariozechner/pi-agent-corevendor/patched-deps/@mariozechner/pi-aivendor/patched-deps/playwright-corenode_modules/mr-memory/index.js

Decision evidence

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Installation automatically runs a package script.
The install script walks bundled dependency snapshots and resolves installed dependency roots.
It copies bundled files over installed dependency files during installation.
It also rewrites mr-memory code, hiding a product name through string concatenation.

Evidence against

No install-time network request or credential collection was found in the inspected lifecycle script.
The Chrome extension code inspected communicates with a local relay only.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2,258 file(s), 48.8 MB of source, external domains: 127.0.0.1, 192.168.1.100, 192.168.1.5, a.sharepoint.com, accounts.google.com, ai-gateway.vercel.sh, aistudio.google.com, albumart.url, alerts.example.com, api.anthropic.com, api.botframework.com, api.cerebras.ai, api.chutes.ai, api.deepgram.com, api.elevenlabs.io, api.example.com, api.firecrawl.dev, api.github.com, api.groq.com, api.individual.githubcopilot.com, api.kilo.ai, api.kimi.com, api.meta.ai, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com, api.push.apple.com, api.sandbox.push.apple.com, api.synthetic.new, api.telegram.org, api.telnyx.com, api.together.xyz, api.twilio.com, api.venice.ai, api.voyageai.com, api.x.ai, api.xiaomimimo.com, api.z.ai, ark.ap-southeast.bytepluses.com, ark.cn-beijing.volces.com, attacker.azureedge.net, auth.openai.com, autopush-cloudcode-pa.sandbox.googleapis.com, b.sharepoint.com, bedrock-runtime.us-east-1.amazonaws.com

Oversized source lightweight scan

dist/compact-B247y5Qt.js3.36 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.elevenlabs.ioapi.openai.comapi.telegram.orgchatgpt.comdocs.openclaw.aiopenrouter.ai

dist/pi-embedded-C6ITuRXf.js3.68 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsapi.elevenlabs.ioapi.openai.comchatgpt.comdocs.openclaw.ai

Source & flagged code

39 flagged

package.jsonView file

Lines 211-251json

211 "types": "./dist/plugin-sdk/zalo.d.ts",

212 "default": "./dist/plugin-sdk/zalo.js"

213 },

214 "./plugin-sdk/zalouser": {

215 "types": "./dist/plugin-sdk/zalouser.d.ts",

216 "default": "./dist/plugin-sdk/zalouser.js"

217 },

218 "./plugin-sdk/account-id": {

219 "types": "./dist/plugin-sdk/account-id.d.ts",

220 "default": "./dist/plugin-sdk/account-id.js"

221 },

222 "./plugin-sdk/keyed-async-queue": {

223 "types": "./dist/plugin-sdk/keyed-async-queue.d.ts",

224 "default": "./dist/plugin-sdk/keyed-async-queue.js"

225 },

226 "./cli-entry": "./johnness.mjs"

227 },

228 "scripts": {

229 "start": "node johnness.mjs",

230 "test": "node --test tests/*.test.mjs",

231 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L231

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L231

232 },

233 "dependencies": {

234 "@agentclientprotocol/sdk": "0.15.0",

235 "@aws-sdk/client-bedrock": "^3.1004.0",

236 "@buape/carbon": "0.0.0-beta-20260216184201",

237 "@clack/prompts": "^1.1.0",

238 "@discordjs/voice": "^0.19.0",

239 "@grammyjs/runner": "^2.0.3",

240 "@grammyjs/transformer-throttler": "^1.2.1",

241 "@homebridge/ciao": "^1.3.5",

242 "@line/bot-sdk": "^10.6.0",

243 "@lydell/node-pty": "1.2.0-beta.3",

244 "@mariozechner/pi-agent-core": "0.55.3",

245 "@mariozechner/pi-ai": "0.55.3",

246 "@mariozechner/pi-coding-agent": "0.55.3",

247 "@mariozechner/pi-tui": "0.55.3",

248 "@mozilla/readability": "^0.6.0",

249 "@sinclair/typebox": "0.34.48",

250 "@slack/bolt": "^4.6.0",

251 "@slack/web-api": "^7.14.1",

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

Lines 1-3javascript

1const e={common:{version:"版本",health:"健康狀況",ok:"正常",offline:"離線",connect:"連接",refresh:"刷新",enabled:"已啟用",disabled:"已禁用",na:"不適用",docs:"文檔",resources:"資源"},nav:{chat:"聊天"

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

Lines 1-28javascript

1import { B as isNodeRuntime, z as isBunRuntime } from "./globals-BM8hKFm0.js";

2import { oi as VERSION } from "./model-selection-L7RMwsG-.js";

3import { _ as resolveNodeSystemdServiceName, c as NODE_WINDOWS_TASK_SCRIPT_NAME, g

dist/update-cli-Cm_l3W29.jsView file

Lines 135-175javascript

135import "./systemd-YuA-rlM2.js";

136import { t as resolveGatewayService } from "./service-D4k98v0P.js";

137import "./lifecycle-core-CYzebOLX.js";

138import "./systemd-hints-CXa8jzon.js";

139import

dist/daemon-cli.jsView file

8import fs from "node:fs/promises"; L9: import { execFile, execFileSync, spawn, spawnSync } from "node:child_process"; L10: import { isDeepStrictEqual, promisify } from "node:util"; ... L18: import { z } from "zod"; L19: import net from "node:net"; L20: import { spinner } from "@clack/prompts"; ... L32: } L33: function resolveEffectiveHomeDir(env = process.env, homedir = os.homedir) { L34: const raw = resolveRawHomeDir(env, homedir); ... L445: consolePatched: false, L446: forceConsoleToStderr: false, L447: consoleTimestampPrefix: false,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L8

479const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L480: return createRequire ? createRequire(metaUrl) : null; L481: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L479

extensions/diffs/src/viewer-assets.tsView file

Lines 1-31typescript

1import crypto from "node:crypto";

2import fs from "node:fs/promises";

3import { fileURLToPath } from "node:url";

5export const

dist/reply-C5LKjXcC.jsView file

55import { n as onSessionTranscriptUpdate, t as emitSessionTranscriptUpdate } from "./transcript-events-svh6aj3U.js"; L56: import { a as canonicalizeBase64, i as resolveImageSanitizationLimits, n as sanitizeImageBlocks, o as estimateBase64DecodedBytes, r as sanitizeToolResultImages } from "./tool-image... L57: import { n as formatToolSummary, r as resolveToolDisplay } from "./tool-display-ILkHoY2-.js"; ... L106: import { n as isQueryStopWordToken, t as extractKeywords } from "./query-expansion-CjS-pLDf.js"; L107: import { a as maxAsk, d as normalizeExecSecurity$1, g as resolveExecApprovalsFromFile, h as resolveExecApprovals, i as loadExecApprovals, l as normalizeExecAsk$1, m as requiresExec... L108: import { _ as applyPathPrepend, a as canvasSnapshotTempPath, b as normalizePathPrepend,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L55

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L55

dist/plugin-sdk/telegram.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/plugin-sdk/telegram.js: baseUrl: z.string().min(1), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), baseUrl: z.string().optional(), message: params.copy?.sourceMessage ?? "Where is this API key stored?",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/telegram.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

17import { fileURLToPath } from "node:url"; L18: import { Agent, EnvHttpProxyAgent } from "undici"; L19: import { lookup } from "node:dns"; L20: import { lookup as lookup$1 } from "node:dns/promises"; ... L68: }; L69: const envToken = accountId === "default" ? normalizeDiscordToken(opts.envToken ?? process.env.DISCORD_BOT_TOKEN, "DISCORD_BOT_TOKEN") : void 0; L70: if (envToken) return { ... L177: }; L178: const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in constants; L179: const OPEN_READ_FLAGS = constants.O_RDONLY | (SUPPORTS_NOFOLLOW ? constants.O_NOFOLLOW : 0); ... L282: } L283: function isPrivateNetworkAllowedByPolicy(policy) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

60Cross-file remote execution chain: dist/compact-B247y5Qt.js spawns dist/export-html/vendor/highlight.min.js; helper contains network access plus dynamic code execution. L60: import { n as onSessionTranscriptUpdate, t as emitSessionTranscriptUpdate } from "./transcript-events-zUwRrpJh.js"; L61: import { a as canonicalizeBase64, i as resolveImageSanitizationLimits, n as sanitizeImageBlocks, o as estimateBase64DecodedBytes, r as sanitizeToolResultImages } from "./tool-image... L62: import { a as normalizeElevatedLevel, c as normalizeUsageDisplay, d as supportsXHighThinking, l as normalizeVerboseLevel, n as formatXHighModelHint, o as normalizeReasoningLevel, s... ... L87: import { c as upsertChannelPairingRequest, f as listPairingChannels, i as readChannelAllowFromStore, l as readJsonFileWithF

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L60

dist/plugin-sdk/index.jsView file

21Trigger-reachable chain: manifest.exports -> dist/plugin-sdk/index.js L21: import { a as openWritableFileWithinRoot, i as openFileWithinRoot, t as SafeOpenError } from "./fs-safe-edcds3oU.js"; L22: import { a as isBlockedHostnameOrIp, i as isBlockedHostname, o as isPrivateIpAddress, t as SsrFBlockedError } from "./ssrf-D5Fmnfel.js"; L23: import { t as fetchWithSsrFGuard } from "./fetch-guard-xQKSiLEQ.js"; ... L65: import { pipeline } from "node:stream/promises"; L66: import { request } from "node:https"; L67: import { Readable, Transform } from "node:stream"; ... L84: success: true, L85: data: void 0 L86: }; ... L702: if (source === "env") { L703: const envVarRaw = await params.prompter.text({ L704: message: params.copy?.envVarMessage ?? "Environment variable name",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

9Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/restart-BzjDMmkD.js L9: import path from "node:path"; L10: import { spawn, spawnSync } from "node:child_process"; L11: import { randomUUID } from "node:crypto"; ... L26: const graceMs = normalizeGraceMs(opts?.graceMs); L27: if (process.platform === "win32") { L28: killProcessTreeWindows(pid, graceMs); ... L125: /** L126: * Parse johnness gateway PIDs from lsof -Fpc stdout. L127: * Pure function — no I/O. Excludes the current process. ... L253: * Blocks until the port is confirmed free (or the poll budget expires) so L254: * the supervisor (systemd / launchctl) does not race a zombie process for L255: * the port and enter an EADDRINUSE restart loop.

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L9

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/plugin-sdk/discord.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/discord.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/discord.jsView on unpkg

dist/plugin-sdk/signal.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/signal.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/signal.jsView on unpkg

dist/chrome-B3GPMnZQ.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/chrome-B3GPMnZQ.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chrome-B3GPMnZQ.jsView on unpkg

dist/plugin-sdk/chrome-BH21wuA9.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/chrome-BH21wuA9.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-BH21wuA9.jsView on unpkg

dist/plugin-sdk/chrome-CpgjIXNk.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/chrome-CpgjIXNk.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-CpgjIXNk.jsView on unpkg

dist/plugin-sdk/chrome-D8oVqHh2.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/chrome-D8oVqHh2.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-D8oVqHh2.jsView on unpkg

dist/plugin-sdk/chrome-RQlOCmEX.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/chrome-RQlOCmEX.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-RQlOCmEX.jsView on unpkg

dist/call-CbaJN9rS.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/call-CbaJN9rS.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/call-CbaJN9rS.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.jsView file

•matchType = normalized_sha256 matchedPackage = johns-harness@2026.9.19 matchedPath = dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.js matchedIdentity = npm:am9obnMtaGFybmVzcw:2026.9.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

Source & flagged code

39 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/control-ui/assets/zh-TW-cW5xB87I.jsView on unpkg · L1

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts

High

Child Process

Package source references child process execution.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

8import fs from "node:fs/promises"; L9: import { execFile } from "node:child_process"; L10: //#region src/daemon/program-args.ts ... L88: const { execFileSync } = await import("node:child_process"); L89: const cmd = process.platform === "win32" ? "where" : "which"; L90: try { ... L95: } catch { L96: if (binary === "bun") throw new Error("Bun not found in PATH. Install bun: https://bun.sh"); L97: throw new Error("Node not found in PATH. Install Node 22+."); ... L229: addNonEmptyDir(dirs, env?.PNPM_HOME); L230: addNonEmptyDir(dirs, appendSubdir(env?.NPM_CONFIG_PREFIX, "bin")); L231: addNonEmptyDir(dirs, appendSubdir(env?.BUN_INSTALL, "bin"));

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/daemon-install-plan.shared-6BfiTrDp.jsView on unpkg · L8

dist/update-cli-Cm_l3W29.jsView file

556} L557: /** Validates a string is safe for embedding in a batch (cmd.exe) script. */ L558: function isBatchSafe(value) {

High

Shell

Package source references shell execution.

dist/update-cli-Cm_l3W29.jsView on unpkg · L556

155import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-d2BV_F6m.js"; L156: import { spawn, spawnSync } from "node:child_process"; L157: import os from "node:os"; ... L171: } L172: const JOHNNESS_REPO_URL = "https://github.com/openclaw/openclaw.git"; L173: const MAX_LOG_CHARS = 8e3; ... L212: function resolveGitInstallDir() { L213: const override = process.env.JOHNNESS_GIT_DIR?.trim(); L214: if (override) return path.resolve(override); ... L217: function resolveDefaultGitDir() { L218: return resolveStateDir(process.env, os.homedir); L219: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/update-cli-Cm_l3W29.jsView on unpkg · L155

dist/daemon-cli.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L8

479const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L480: return createRequire ? createRequire(metaUrl) : null; L481: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L479

extensions/diffs/src/viewer-assets.tsView file

11export type ServedViewerAsset = { L12: body: string | Buffer; L13: contentType: string;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/diffs/src/viewer-assets.tsView on unpkg · L11

dist/reply-C5LKjXcC.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L55

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L55

dist/plugin-sdk/telegram.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L60

dist/plugin-sdk/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L9

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/plugin-sdk/discord.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/discord.jsView on unpkg

dist/plugin-sdk/signal.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/signal.jsView on unpkg

dist/chrome-B3GPMnZQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chrome-B3GPMnZQ.jsView on unpkg

dist/plugin-sdk/chrome-BH21wuA9.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-BH21wuA9.jsView on unpkg

dist/plugin-sdk/chrome-CpgjIXNk.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-CpgjIXNk.jsView on unpkg

dist/plugin-sdk/chrome-D8oVqHh2.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-D8oVqHh2.jsView on unpkg

dist/plugin-sdk/chrome-RQlOCmEX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-RQlOCmEX.jsView on unpkg

dist/call-CbaJN9rS.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/call-CbaJN9rS.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

Findings

4 Critical23 High14 Medium7 Low

CriticalHardcoded Runtime Data Exfiltrationdist/reply-C5LKjXcC.js

CriticalCredential Exfiltrationdist/reply-C5LKjXcC.js

CriticalRemote Asset Decode Executedist/reply-C5LKjXcC.js

CriticalTrigger Reachable Dangerous Capabilitydist/plugin-sdk/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/daemon-install-plan.shared-6BfiTrDp.js

HighShelldist/update-cli-Cm_l3W29.js

HighCredential Redirect Persistencedist/plugin-sdk/telegram.js

HighCommand Output Exfiltrationdist/daemon-cli.js

HighSandbox Evasion Gated Capabilitydist/daemon-install-plan.shared-6BfiTrDp.js

HighCloud Metadata Accessdist/shared-Cg8lr3fh.js

HighCross File Remote Execution Contextdist/compact-B247y5Qt.js

HighTrigger Reachable Credential Exfiltrationdist/reply-C5LKjXcC.js

HighTrigger Reachable Persistencedist/restart-BzjDMmkD.js

HighSemantic Analysis Limiteddist/logger-Bj0Xl6pn.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist/plugin-sdk/discord.js

HighKnown Malware Source Similaritydist/plugin-sdk/signal.js

HighKnown Malware Source Similaritydist/plugin-sdk/telegram.js

HighKnown Malware Source Similaritydist/chrome-B3GPMnZQ.js

HighKnown Malware Source Similaritydist/plugin-sdk/chrome-BH21wuA9.js

HighKnown Malware Source Similaritydist/plugin-sdk/chrome-CpgjIXNk.js

HighKnown Malware Source Similaritydist/plugin-sdk/chrome-D8oVqHh2.js

HighKnown Malware Source Similaritydist/plugin-sdk/chrome-RQlOCmEX.js

HighKnown Malware Source Similaritydist/call-CbaJN9rS.js

HighKnown Malware Source Similaritydist/plugin-sdk/pi-embedded-helpers-BnFhV3or.js

HighKnown Malware Source Similaritydist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.js

HighKnown Malware Source Similaritydist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patterndist/control-ui/assets/zh-TW-cW5xB87I.js

MediumDynamic Requiredist/daemon-cli.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/update-cli-Cm_l3W29.js

MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py

MediumOversized Source Fileextensions/diffs/assets/viewer-runtime.js

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/control-ui/assets/es-DHtyqUQZ.js

MediumSecret Patterndist/control-ui/assets/zh-CN-BgJ8_lE3.js

MediumSecret Patterndist/control-ui/assets/index-CvRIBzDR.js

MediumSecret Patterndist/control-ui/assets/pt-BR-D2dJb9G8.js

MediumSecret Patterndist/control-ui/assets/de-DuUYLvt1.js

LowScripts Present

LowEval

LowWeak Cryptoextensions/diffs/src/viewer-assets.ts

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

39 flagged

package.jsonView file

Lines 211-251json

211 "types": "./dist/plugin-sdk/zalo.d.ts",

212 "default": "./dist/plugin-sdk/zalo.js"

213 },

214 "./plugin-sdk/zalouser": {

215 "types": "./dist/plugin-sdk/zalouser.d.ts",

216 "default": "./dist/plugin-sdk/zalouser.js"

217 },

218 "./plugin-sdk/account-id": {

219 "types": "./dist/plugin-sdk/account-id.d.ts",

220 "default": "./dist/plugin-sdk/account-id.js"

221 },

222 "./plugin-sdk/keyed-async-queue": {

223 "types": "./dist/plugin-sdk/keyed-async-queue.d.ts",

224 "default": "./dist/plugin-sdk/keyed-async-queue.js"

225 },

226 "./cli-entry": "./johnness.mjs"

227 },

228 "scripts": {

229 "start": "node johnness.mjs",

230 "test": "node --test tests/*.test.mjs",

231 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L231

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L231

232 },

233 "dependencies": {

234 "@agentclientprotocol/sdk": "0.15.0",

235 "@aws-sdk/client-bedrock": "^3.1004.0",

236 "@buape/carbon": "0.0.0-beta-20260216184201",

237 "@clack/prompts": "^1.1.0",

238 "@discordjs/voice": "^0.19.0",

239 "@grammyjs/runner": "^2.0.3",

240 "@grammyjs/transformer-throttler": "^1.2.1",

241 "@homebridge/ciao": "^1.3.5",

242 "@line/bot-sdk": "^10.6.0",

243 "@lydell/node-pty": "1.2.0-beta.3",

244 "@mariozechner/pi-agent-core": "0.55.3",

245 "@mariozechner/pi-ai": "0.55.3",

246 "@mariozechner/pi-coding-agent": "0.55.3",

247 "@mariozechner/pi-tui": "0.55.3",

248 "@mozilla/readability": "^0.6.0",

249 "@sinclair/typebox": "0.34.48",

250 "@slack/bolt": "^4.6.0",

251 "@slack/web-api": "^7.14.1",

dist/control-ui/assets/zh-TW-cW5xB87I.jsView file

Lines 1-3javascript

dist/daemon-install-plan.shared-6BfiTrDp.jsView file

Lines 1-28javascript

1import { B as isNodeRuntime, z as isBunRuntime } from "./globals-BM8hKFm0.js";

2import { oi as VERSION } from "./model-selection-L7RMwsG-.js";

3import { _ as resolveNodeSystemdServiceName, c as NODE_WINDOWS_TASK_SCRIPT_NAME, g

dist/update-cli-Cm_l3W29.jsView file

Lines 135-175javascript

135import "./systemd-YuA-rlM2.js";

136import { t as resolveGatewayService } from "./service-D4k98v0P.js";

137import "./lifecycle-core-CYzebOLX.js";

138import "./systemd-hints-CXa8jzon.js";

139import

dist/daemon-cli.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-cli.jsView on unpkg · L8

479const createRequire = typeof moduleNamespace.createRequire === "function" ? moduleNamespace.createRequire : null; L480: return createRequire ? createRequire(metaUrl) : null; L481: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/daemon-cli.jsView on unpkg · L479

extensions/diffs/src/viewer-assets.tsView file

Lines 1-31typescript

1import crypto from "node:crypto";

2import fs from "node:fs/promises";

3import { fileURLToPath } from "node:url";

5export const

dist/reply-C5LKjXcC.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/reply-C5LKjXcC.jsView on unpkg · L55

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/reply-C5LKjXcC.jsView on unpkg · L55

dist/plugin-sdk/telegram.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/plugin-sdk/telegram.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/telegram.jsView on unpkg

dist/shared-Cg8lr3fh.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/shared-Cg8lr3fh.jsView on unpkg · L17

dist/compact-B247y5Qt.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/compact-B247y5Qt.jsView on unpkg · L60

dist/plugin-sdk/index.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/plugin-sdk/index.jsView on unpkg · L21

dist/restart-BzjDMmkD.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/restart-BzjDMmkD.jsView on unpkg · L9

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

extensions/diffs/assets/viewer-runtime.jsView file

•path = extensions/diffs/assets/viewer-runtime.js kind = oversized_source_file sizeBytes = 9753906 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

extensions/diffs/assets/viewer-runtime.jsView on unpkg

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 23

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/logger-Bj0Xl6pn.js#virtual:normalized:round1View on unpkg

dist/plugin-sdk/discord.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/discord.jsView on unpkg

dist/plugin-sdk/signal.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/signal.jsView on unpkg

dist/chrome-B3GPMnZQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chrome-B3GPMnZQ.jsView on unpkg

dist/plugin-sdk/chrome-BH21wuA9.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-BH21wuA9.jsView on unpkg

dist/plugin-sdk/chrome-CpgjIXNk.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-CpgjIXNk.jsView on unpkg

dist/plugin-sdk/chrome-D8oVqHh2.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-D8oVqHh2.jsView on unpkg

dist/plugin-sdk/chrome-RQlOCmEX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/chrome-RQlOCmEX.jsView on unpkg

dist/call-CbaJN9rS.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/call-CbaJN9rS.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-BnFhV3or.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-CY7PsNpl.jsView on unpkg

dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/pi-embedded-helpers-Dira0ZRW.jsView on unpkg

dist/control-ui/assets/es-DHtyqUQZ.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/es-DHtyqUQZ.js

dist/control-ui/assets/es-DHtyqUQZ.jsView on unpkg · L1

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/zh-CN-BgJ8_lE3.js

dist/control-ui/assets/zh-CN-BgJ8_lE3.jsView on unpkg · L1

dist/control-ui/assets/index-CvRIBzDR.jsView file

3patternName = generic_password severity = medium line = 3

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/index-CvRIBzDR.js

dist/control-ui/assets/index-CvRIBzDR.jsView on unpkg · L3

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/pt-BR-D2dJb9G8.js

dist/control-ui/assets/pt-BR-D2dJb9G8.jsView on unpkg · L1

dist/control-ui/assets/de-DuUYLvt1.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/control-ui/assets/de-DuUYLvt1.js

dist/control-ui/assets/de-DuUYLvt1.jsView on unpkg · L1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code