Loading npm security reports…

lm-assist@0.2.4: AI-agent control-surface risk | LPM Firewall

registry / lm-assist / 0.2.4

lm-assist@0.2.4

Full observability & control for the Claude product line — Claude Code (local/remote/cloud), claude.ai conversations, Cowork, agents, memory, connectors, usage — via web dashboard, REST API, and MCP tools

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically starts services and modifies Claude Code integration. It installs a marketplace plugin and configures a status-line command without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation runs the postinstall lifecycle hook.

Impact

It changes a broad AI-agent control surface and starts package services during installation.

Mechanism

Postinstall service startup and Claude Code plugin/configuration mutation.

Policy narrative

Installing the package globally triggers postinstall. The script starts lm-assist services, calls a local endpoint that writes a status-line command into Claude Code settings, and uses the Claude CLI to add a marketplace and install a plugin. These changes occur without an explicit lm-assist setup command.

AI rationale

The automatic postinstall chain mutates Claude Code's control surface and installs an external plugin during npm installation. This is concrete unconsented install-hook abuse.

Evidence

package.jsonbin/postinstall.jscore/dist/routes/core/claude-code.routes.js~/.claude/settings.json~/.claude/plugins/installed_plugins.json

Network endpoints1

127.0.0.1

Decision evidence

Source & flagged code

34 flagged

package.jsonView file

44Install-time code directly mutates a foreign AI-agent control surface: L44: "bin", L45: ".claude-plugin", L46: ".mcp.json", L47: "commands", Write operation from core/dist/utils/install-source.js: L65: const f = markerFile(); L66: fs.mkdirSync(path.dirname(f), { recursive: true }); L67: const tmp = f + '.tmp'; L68: fs.writeFileSync(tmp, JSON.stringify(rec, null, 2), { mode: 0o600 }); L69: fs.renameSync(tmp, f); Foreign user/project scope from core/dist/utils/path-utils.js: L303: * Get the Claude config directory L304: * Default: ~/.claude L305: * Can be overridden with CLAUDE_CONFIG_DIR env var ... L307: function getClaudeConfigDir() { L308: return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude'); L309: } ... L311: * Get the projects directory L312: * Default: ~/.claude/

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

core/dist/service-manager.jsView file

Lines 38-78javascript

38 return result;

39 };

40})();

41Object.defineProperty(exports, "__esModule", { value: true });

42exports.startCore = startCore;

43exports.startWeb =

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

39}; L40: var __privateIn = (member, obj) => { L41: if (Object(obj) !== obj) ... L71: L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js L73: var require_symbols = __commonJS({ ... L98: kBodyUsed: Symbol("used"), L99: kBody: Symbol("abstracted request body"), L100: kRunning: Symbol("running"), ... L564: } L565: const code = this.code = key.charCodeAt(index); L566: if (code > 127) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

core/dist/routes/core/tmux.routes.jsView file

52Trigger-reachable persistence chain: manifest.main -> core/dist/index.js -> core/dist/rest-server.js -> core/dist/routes/index.js -> core/dist/routes/core/index.js -> core/dist/routes/core/tmux.routes.js L52: const process_utils_1 = require("../../utils/process-utils"); L53: const BASHRC = path.join(os.homedir(), '.bashrc'); L54: const TMUX_CONF = path.join(os.homedir(), '.tmux.conf'); ... L63: const raw = fs.readFileSync(TMUX_CONFIG_FILE, 'utf-8'); L64: const parsed = JSON.parse(raw); L65: return { ... L81: try { L82: const out = (0, exec_1.execFileSync)('tmux', ['-V'], { encoding: 'utf-8', timeout: 5000 }).trim(); L83: installed = true; ... L139: } L140: const inTmuxSession = !!process.env.TMUX; L141: return {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

52const process_utils_1 = require("../../utils/process-utils"); L53: const BASHRC = path.join(os.homedir(), '.bashrc'); L54: const TMUX_CONF = path.join(os.homedir(), '.tmux.conf'); ... L63: const raw = fs.readFileSync(TMUX_CONFIG_FILE, 'utf-8'); L64: const parsed = JSON.parse(raw); L65: return { ... L81: try { L82: const out = (0, exec_1.execFileSync)('tmux', ['-V'], { encoding: 'utf-8', timeout: 5000 }).trim(); L83: installed = true; ... L139: } L140: const inTmuxSession = !!process.env.TMUX; L141: return {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

core/scripts/memory-reconcile.jsView file

19const os = require('os'); L20: const http = require('http'); L21: const { loopbackAuthHeader } = require('./lib/loopback-auth'); L22: const { execFileSync } = require('child_process'); L23: L24: const PORT = process.env.API_PORT || (__dirname.includes('node_modules') ? '3100' : '3200'); L25: const MAP_SCRIPT = path.join(__dirname, 'memory-map.js');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/scripts/memory-reconcile.jsView on unpkg · L19

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={462:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

bin/lm-assist.jsView file

25Cross-file remote execution chain: bin/lm-assist.js spawns core/dist/backup/config.js; helper contains network access plus dynamic code execution. L25: try { L26: const dir = process.env.LM_ASSIST_DATA_DIR || path.join(os.homedir(), '.lm-assist'); L27: const t = fs.readFileSync(path.join(dir, 'api-token'), 'utf8').trim(); ... L54: const cfgPath = path.join(os.homedir(), '.claude-code-config.json'); L55: const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8')); L56: return { ... L169: L170: More info: https://github.com/langmartai/lm-assist L171: `); ... L192: fs.copyFileSync(upgradeScript, tmpScript); L193: const { execFileSync } = require('child_process'); L194: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 80

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = bin/lm-assist.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lm-assist.js

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

core/dist/ui-pages/manager.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/ui-pages/manager.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ui-pages/manager.jsView on unpkg

core/dist/cli-runner.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/cli-runner.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/cli-runner.jsView on unpkg

bin/postinstall.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = bin/postinstall.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

core/dist/mcp-server/plugins/client.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/mcp-server/plugins/client.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/mcp-server/plugins/client.jsView on unpkg

core/dist/memory/autosync.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/memory/autosync.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/autosync.jsView on unpkg

core/dist/memory/harvest-daemon.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/memory/harvest-daemon.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/harvest-daemon.jsView on unpkg

core/dist/rest-server.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/rest-server.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/rest-server.jsView on unpkg

core/dist/routes/core/dev-mode.routes.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/routes/core/dev-mode.routes.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/dev-mode.routes.jsView on unpkg

core/dist/routes/core/machine-access.routes.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/routes/core/machine-access.routes.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/machine-access.routes.jsView on unpkg

core/dist/ttyd-manager.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/ttyd-manager.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ttyd-manager.jsView on unpkg

core/dist/utils/claude-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = lm-assist@0.2.0 matchedPath = core/dist/utils/claude-oauth.js matchedIdentity = npm:bG0tYXNzaXN0:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/utils/claude-oauth.jsView on unpkg

Source & flagged code

34 flagged · loading source

package.jsonView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

core/dist/service-manager.jsView file

58exports.readDevLog = readDevLog; L59: const child_process_1 = require("child_process"); L60: const fs = __importStar(require("fs")); L61: const path = __importStar(require("path")); L62: const net = __importStar(require("net")); L63: const os = __importStar(require("os")); ... L67: // ─── Paths ────────────────────────────────────────────────── L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..'); L69: function findNpmPackage() { ... L169: return { L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10), L171: webPort: cfg?.webPort || parseInt(process.env.WEB_PORT || env.WEB_PORT || defaults.web, 10),

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

core/dist/service-manager.jsView on unpkg · L58

58Trigger-reachable chain: manifest.main -> core/dist/index.js -> core/dist/rest-server.js -> core/dist/routes/index.js -> core/dist/routes/core/index.js -> core/dist/routes/core/claude-code.routes.js -> core/dist/service-manager.js L58: exports.readDevLog = readDevLog; L59: const child_process_1 = require("child_process"); L60: const fs = __importStar(require("fs")); L61: const path = __importStar(require("path")); L62: const net = __importStar(require("net")); L63: const os = __importStar(require("os")); ... L67: // ─── Paths ────────────────────────────────────────────────── L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..'); L69: function findNpmPackage() { ... L169: return { L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10)

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

core/dist/service-manager.jsView on unpkg · L58

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

47exports.deleteProjectSummary = deleteProjectSummary; L48: const fs = __importStar(require("fs")); L49: const path = __importStar(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/dist/project-summary-store.jsView on unpkg · L47

core/dist/routes/core/tmux.routes.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

core/scripts/memory-reconcile.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/scripts/memory-reconcile.jsView on unpkg · L19

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={462:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

bin/lm-assist.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 80

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lm-assist.js

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

core/dist/ui-pages/manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ui-pages/manager.jsView on unpkg

core/dist/cli-runner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/cli-runner.jsView on unpkg

bin/postinstall.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

core/dist/mcp-server/plugins/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/mcp-server/plugins/client.jsView on unpkg

core/dist/memory/autosync.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/autosync.jsView on unpkg

core/dist/memory/harvest-daemon.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/harvest-daemon.jsView on unpkg

core/dist/rest-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/rest-server.jsView on unpkg

core/dist/routes/core/dev-mode.routes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/dev-mode.routes.jsView on unpkg

core/dist/routes/core/machine-access.routes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/machine-access.routes.jsView on unpkg

core/dist/ttyd-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ttyd-manager.jsView on unpkg

core/dist/utils/claude-oauth.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/utils/claude-oauth.jsView on unpkg

Findings

3 Critical24 High9 Medium8 Low

CriticalReverse Shellcore/dist/service-manager.js

CriticalAi Agent Control Hijackpackage.json

CriticalTrigger Reachable Dangerous Capabilitycore/dist/service-manager.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcore/dist/service-manager.js

HighShell

HighSame File Env Network Executioncore/scripts/memory-reconcile.js

HighCommand Output Exfiltrationweb/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js

HighSandbox Evasion Gated Capabilitycore/dist/service-manager.js

HighCross File Remote Execution Contextbin/lm-assist.js

HighTrigger Reachable Persistencecore/dist/routes/core/tmux.routes.js

HighRuntime Package Installcore/scripts/verify-deploy.mjs

HighShips High Entropy Blobweb/.next/standalone/web/.next/server/app/icon.png.body

HighPayload In Excluded Dirweb/.next/standalone/web/.next/server/app/icon.png.body

HighSemantic Analysis Limitedbin/lm-assist.js

HighKnown Malware Source Similaritycore/dist/ui-pages/manager.js

HighKnown Malware Source Similaritycore/dist/cli-runner.js

HighKnown Malware Source Similaritybin/lm-assist.js

HighKnown Malware Source Similaritybin/postinstall.js

HighKnown Malware Source Similaritycore/dist/mcp-server/plugins/client.js

HighKnown Malware Source Similaritycore/dist/memory/autosync.js

HighKnown Malware Source Similaritycore/dist/memory/harvest-daemon.js

HighKnown Malware Source Similaritycore/dist/rest-server.js

HighKnown Malware Source Similaritycore/dist/routes/core/dev-mode.routes.js

HighKnown Malware Source Similaritycore/dist/routes/core/machine-access.routes.js

HighKnown Malware Source Similaritycore/dist/ttyd-manager.js

HighKnown Malware Source Similaritycore/dist/utils/claude-oauth.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirecore/dist/project-summary-store.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecore/dist/routes/core/tmux.routes.js

MediumShips Native Binaryweb/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3

MediumShips Build Helpercore/hooks/statusline-worktree.sh

MediumOversized Source Fileweb/.next/standalone/node_modules/typescript/lib/typescript.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalweb/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js

LowWeak Cryptoweb/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

34 flagged

package.jsonView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

package.jsonView on unpkg · L44

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

core/dist/service-manager.jsView file

Lines 38-78javascript

38 return result;

39 };

40})();

41Object.defineProperty(exports, "__esModule", { value: true });

42exports.startCore = startCore;

43exports.startWeb =

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView file

18699throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire); L18700: eval(getModuleCode)( L18701: module,

Low

Eval

Package source references a known benign dynamic code generation pattern.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L18699

Low

Weak Crypto

Package source references weak cryptographic algorithms.

web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.jsView on unpkg · L39

core/dist/project-summary-store.jsView file

Lines 27-67javascript

27 var ownKeys = function(o) {

28 ownKeys = Object.getOwnPropertyNames || function (o) {

29 var ar = [];

core/dist/routes/core/tmux.routes.jsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

core/dist/routes/core/tmux.routes.jsView on unpkg · L52

core/scripts/memory-reconcile.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/scripts/memory-reconcile.jsView on unpkg · L19

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView file

1(()=>{var __webpack_modules__={462:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.jsView on unpkg · L1

bin/lm-assist.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/lm-assist.jsView on unpkg · L25

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 80

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/lm-assist.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/lm-assist.js

core/scripts/verify-deploy.mjsView file

106try { L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' }); L108: ok.push('typecheck clean (tsc --noEmit)');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/scripts/verify-deploy.mjsView on unpkg · L106

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View file

•path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 kind = native_binary sizeBytes = 16645008 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3View on unpkg

core/hooks/statusline-worktree.shView file

•path = core/hooks/statusline-worktree.sh kind = build_helper sizeBytes = 9173 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/hooks/statusline-worktree.shView on unpkg

web/.next/standalone/web/.next/server/app/icon.png.bodyView file

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = high_entropy_blob sizeBytes = 43748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

•path = web/.next/standalone/web/.next/server/app/icon.png.body kind = payload_in_excluded_dir sizeBytes = 43748 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

web/.next/standalone/web/.next/server/app/icon.png.bodyView on unpkg

web/.next/standalone/node_modules/typescript/lib/typescript.jsView file

•path = web/.next/standalone/node_modules/typescript/lib/typescript.js kind = oversized_source_file sizeBytes = 9112572 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web/.next/standalone/node_modules/typescript/lib/typescript.jsView on unpkg

core/dist/ui-pages/manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ui-pages/manager.jsView on unpkg

core/dist/cli-runner.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/cli-runner.jsView on unpkg

bin/postinstall.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

core/dist/mcp-server/plugins/client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/mcp-server/plugins/client.jsView on unpkg

core/dist/memory/autosync.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/autosync.jsView on unpkg

core/dist/memory/harvest-daemon.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/memory/harvest-daemon.jsView on unpkg

core/dist/rest-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/rest-server.jsView on unpkg

core/dist/routes/core/dev-mode.routes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/dev-mode.routes.jsView on unpkg

core/dist/routes/core/machine-access.routes.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/routes/core/machine-access.routes.jsView on unpkg

core/dist/ttyd-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/ttyd-manager.jsView on unpkg

core/dist/utils/claude-oauth.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/utils/claude-oauth.jsView on unpkg

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code