Loading npm security reports…
lm-assist@0.2.5: Agent extension lifecycle risk – flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
lm-assist@0.2.5 Full observability & control for the Claude product line — Claude Code (local/remote/cloud), claude.ai conversations, Cowork, agents, memory, connectors, usage — via web dashboard, REST API, and MCP tools
scanned 1mo ago · by lpm-firewall-ai Postinstall automatically writes a package-owned statusLine command into ~/.claude/settings.json and installs the publisher's Claude Code plugin. That is first-party agent extension setup during install, with no separate exfiltration, remote payload, or self-install chain in the inspected path.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm postinstall runs node bin/postinstall.js whenever __dirname contains node_modules.
Impact
Claude Code sessions pick up this package's status line command and the same publisher's plugin without a separate confirmation step. The change is limited to that product hook and plugin; the inspected path does not send credentials or fetch a remote payload.
Mechanism
The script starts bin/lm-assist.js, POSTs to 127.0.0.1:3100/claude-code/statusline/install, which sets statusLine.command to node running the package statusline-worktree.js hook and writes the home Claude settings file, then invokes the claude CLI to add marketplace langmartai/lm-assist and install claude-code-multisession@langmartai.
AI rationale
Postinstall automatically writes a package-owned statusLine command into ~/.claude/settings.json and installs the publisher's Claude Code plugin. That is first-party agent extension setup during install, with no separate exfiltration, remote payload, or self-install chain in the inspected path.
Evidence
package.json bin/postinstall.js core/dist/routes/core/claude-code.routes.js ~/.claude/settings.json
Network endpoints1
127.0.0.1:3100 /claude-code/statusline/install
public snapshot AI called this Suspicious at 78.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
package.json registers a postinstall script that runs node bin/postinstall.js. When the install directory path contains node_modules, postinstall starts the package CLI and POSTs to 127.0.0.1:3100 /claude-code/statusline/install. The same postinstall runs claude plugin marketplace add langmartai/lm-assist and claude plugin install claude-code-multisession@langmartai with no prompt. The statusline route sets settings.statusLine to a command that runs the package statusline-worktree.js hook and writes ~/.claude/settings.json. Evidence against
The plugin and marketplace names match the package author langmartai and the package's own Claude integration. The statusline write keeps other settings keys and points the command at this package's hook script. Memory harvest stays off unless MEMORY_HARVEST_DAEMON=on and only writes local proposal files. No preinstall hook and no runtime dependency on another release of lm-assist. Behavioral surface
Source ChildProcess Crypto DynamicRequire
34 flagged · loading source 44 Install-time code directly mutates a foreign AI-agent control surface:
L44: "bin",
L45: ".claude-plugin",
L46: ".mcp.json",
L47: "commands",
Write operation from core/dist/utils/install-source.js:
L65: const f = markerFile();
L66: fs.mkdirSync(path.dirname(f), { recursive: true });
L67: const tmp = f + '.tmp';
L68: fs.writeFileSync(tmp, JSON.stringify(rec, null, 2), { mode: 0o600 });
L69: fs.renameSync(tmp, f);
Foreign user/project scope from core/dist/utils/path-utils.js:
L303: * Get the Claude config directory
L304: * Default: ~/.claude
L305: * Can be overridden with CLAUDE_CONFIG_DIR env var
...
L307: function getClaudeConfigDir() {
L308: return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
L309: }
...
L311: * Get the projects directory
L312: * Default: ~/.claude/
Critical Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.json View on unpkg · L44 • scripts.postinstall = node bin/postinstall.js
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node bin/postinstall.js
2 Critical 24 High 9 Medium 8 Low
Critical Reverse Shell core/dist/service-manager.js
Critical Ai Agent Control Hijack package.json
High Install Time Lifecycle Scripts package.json
High Child Process core/dist/service-manager.js
High Shell core/dist/service-manager.js
High Same File Env Network Execution core/scripts/memory-reconcile.js
High Command Output Exfiltration web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js
High Sandbox Evasion Gated Capability core/dist/service-manager.js
High Cross File Remote Execution Context bin/lm-assist.js
High Trigger Reachable Persistence core/dist/routes/core/tmux.routes.js
High
Affected versions and remediation This report applies to lm-assist@0.2.5 .
See all versions of lm-assist for other recorded verdicts.
Review the evidence and your use of lm-assist@0.2.5 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-23 09:54:03.998Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
78% Suspicious
AI assessment confidence
Package metadata npm Author langmartai
Maintainers langmartadmin
Version 0.2.5
Published Sep 23, 2026
License AGPL-3.0-or-later
Dependencies 21
Integrity verified
Package size 36.4 MB
Files 5,824
Keywords claude-code claude mcp agents observability session-management fleet web-terminal
EnvironmentVars
Eval
Filesystem
Network
Shell
WebSocket
Supply chain HighEntropyStrings PossibleObfuscation UrlStrings
scanned 676 file(s), 8.65 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.langmart.ai, assist.langmart.ai, claude.ai, github.com, graph.facebook.com, local-tier.invalid, mail.google.com, nodejs.org, opencode.ai, platform.claude.com, raw.githubusercontent.com, www.linkedin.com
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json
58 exports.readDevLog = readDevLog;
L59: const child_process_1 = require("child_process");
L60: const fs = __importStar(require("fs"));
L61: const path = __importStar(require("path"));
L62: const net = __importStar(require("net"));
L63: const os = __importStar(require("os"));
...
L67: // ─── Paths ──────────────────────────────────────────────────
L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..');
L69: function findNpmPackage() {
...
L169: return {
L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10),
L171: webPort: cfg?.webPort || parseInt(process.env.WEB_PORT || env.WEB_PORT || defaults.web, 10),
Critical Reverse Shell
Source matches reverse-shell style process and socket wiring.
core/dist/service-manager.js View on unpkg · L58 58 exports.readDevLog = readDevLog;
L59: const child_process_1 = require("child_process");
L60: const fs = __importStar(require("fs"));
High Child Process
Package source references child process execution.
core/dist/service-manager.js View on unpkg · L58 205 try {
L206: const out = (0, child_process_1.execFileSync)('powershell', ['-NoProfile', '-Command', `(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).SessionId`], { encoding: 'utf8', time...
L207: const n = parseInt(String(out).trim(), 10);
58 exports.readDevLog = readDevLog;
L59: const child_process_1 = require("child_process");
L60: const fs = __importStar(require("fs"));
L61: const path = __importStar(require("path"));
L62: const net = __importStar(require("net"));
L63: const os = __importStar(require("os"));
...
L67: // ─── Paths ──────────────────────────────────────────────────
L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..');
L69: function findNpmPackage() {
...
L169: return {
L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10),
L171: webPort: cfg?.webPort || parseInt(process.env.WEB_PORT || env.WEB_PORT || defaults.web, 10),
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
core/dist/service-manager.js View on unpkg · L58 web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js View file 18699 throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire);
L18700: eval(getModuleCode)(
L18701: module,
Low Eval
Package source references a known benign dynamic code generation pattern.
web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js View on unpkg · L18699 39 };
L40: var __privateIn = (member, obj) => {
L41: if (Object(obj) !== obj)
...
L71:
L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js
L73: var require_symbols = __commonJS({
...
L98: kBodyUsed: Symbol("used"),
L99: kBody: Symbol("abstracted request body"),
L100: kRunning: Symbol("running"),
...
L564: }
L565: const code = this.code = key.charCodeAt(index);
L566: if (code > 127) {
Low Weak Crypto
Package source references weak cryptographic algorithms.
web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js View on unpkg · L39 47 exports.deleteProjectSummary = deleteProjectSummary;
L48: const fs = __importStar(require("fs"));
L49: const path = __importStar(require("path"));
Medium Dynamic Require
Package source references dynamic require/import behavior.
core/dist/project-summary-store.js View on unpkg · L47 25 L26: const { execFileSync } = require('child_process');
L27: const fs = require('fs');
...
L30:
L31: const isWindows = process.platform === 'win32';
L32: const isMac = process.platform === 'darwin';
...
L35:
L36: const LOG_DIR = path.join(os.homedir(), '.cache', 'lm-assist');
L37: const LOG_FILE = path.join(LOG_DIR, 'upgrade.log');
...
L48: fs.appendFileSync(LOG_FILE, line);
L49: process.stdout.write(line);
L50: }
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
core/scripts/upgrade.js View on unpkg · L25 19 const os = require('os');
L20: const http = require('http');
L21: const { loopbackAuthHeader } = require('./lib/loopback-auth');
L22: const { execFileSync } = require('child_process');
L23:
L24: const PORT = process.env.API_PORT || (__dirname.includes('node_modules') ? '3100' : '3200');
L25: const MAP_SCRIPT = path.join(__dirname, 'memory-map.js');
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
core/scripts/memory-reconcile.js View on unpkg · L19 web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js View file 1 (()=>{var __webpack_modules__={462:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js View on unpkg · L1 25 Cross-file remote execution chain: bin/lm-assist.js spawns core/dist/backup/config.js; helper contains network access plus dynamic code execution.
L25: try {
L26: const dir = process.env.LM_ASSIST_DATA_DIR || path.join(os.homedir(), '.lm-assist');
L27: const t = fs.readFileSync(path.join(dir, 'api-token'), 'utf8').trim();
...
L54: const cfgPath = path.join(os.homedir(), '.claude-code-config.json');
L55: const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
L56: return {
...
L169:
L170: More info: https://github.com/langmartai/lm-assist
L171: `);
...
L192: fs.copyFileSync(upgradeScript, tmpScript);
L193: const { execFileSync } = require('child_process');
L194: try {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/lm-assist.js View on unpkg · L25 • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 82
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/lm-assist.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = bin/lm-assist.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/lm-assist.js View on unpkg core/dist/routes/core/tmux.routes.js View file 52 Trigger-reachable persistence chain: manifest.main -> core/dist/index.js -> core/dist/rest-server.js -> core/dist/routes/index.js -> core/dist/routes/core/index.js -> core/dist/routes/core/tmux.routes.js
L52: const process_utils_1 = require("../../utils/process-utils");
L53: const BASHRC = path.join(os.homedir(), '.bashrc');
L54: const TMUX_CONF = path.join(os.homedir(), '.tmux.conf');
...
L63: const raw = fs.readFileSync(TMUX_CONFIG_FILE, 'utf-8');
L64: const parsed = JSON.parse(raw);
L65: return {
...
L81: try {
L82: const out = (0, exec_1.execFileSync)('tmux', ['-V'], { encoding: 'utf-8', timeout: 5000 }).trim();
L83: installed = true;
...
L139: }
L140: const inTmuxSession = !!process.env.TMUX;
L141: return {
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
core/dist/routes/core/tmux.routes.js View on unpkg · L52 106 try {
L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' });
L108: ok.push('typecheck clean (tsc --noEmit)');
High Runtime Package Install
Package source invokes a package manager install command at runtime.
core/scripts/verify-deploy.mjs View on unpkg · L106 web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 View file • path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3
kind = native_binary
sizeBytes = 16645008
magicHex = [redacted]
Medium Ships Native Binary
Package ships native binary artifacts.
web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 View on unpkg • path = core/hooks/statusline-worktree.sh
kind = build_helper
sizeBytes = 9173
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
core/hooks/statusline-worktree.sh View on unpkg web/.next/standalone/web/.next/server/app/icon.png.body View file • path = web/.next/standalone/web/.next/server/app/icon.png.body
kind = high_entropy_blob
sizeBytes = 43748
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
web/.next/standalone/web/.next/server/app/icon.png.body View on unpkg • path = web/.next/standalone/web/.next/server/app/icon.png.body
kind = payload_in_excluded_dir
sizeBytes = 43748
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
web/.next/standalone/web/.next/server/app/icon.png.body View on unpkg web/.next/standalone/node_modules/typescript/lib/typescript.js View file • path = web/.next/standalone/node_modules/typescript/lib/typescript.js
kind = oversized_source_file
sizeBytes = 9112572
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
web/.next/standalone/node_modules/typescript/lib/typescript.js View on unpkg core/dist/utils/claudeai-browser-launch.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/utils/claudeai-browser-launch.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/utils/claudeai-browser-launch.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/ui-pages/manager.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/ui-pages/manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/cli-runner.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/cli-runner.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = bin/postinstall.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/postinstall.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/agent-session-store.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/agent-session-store.js View on unpkg core/dist/hub-client/port-forward-handler.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/hub-client/port-forward-handler.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/hub-client/port-forward-handler.js View on unpkg core/dist/mcp-server/plugins/client.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/mcp-server/plugins/client.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/mcp-server/plugins/client.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/memory/autosync.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/memory/autosync.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/memory/harvest-daemon.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/memory/harvest-daemon.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/rest-server.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/rest-server.js View on unpkg core/dist/routes/core/dev-mode.routes.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/routes/core/dev-mode.routes.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/routes/core/dev-mode.routes.js View on unpkg Runtime Package Install
core/scripts/verify-deploy.mjs
High Ships High Entropy Blob web/.next/standalone/web/.next/server/app/icon.png.body
High Payload In Excluded Dir web/.next/standalone/web/.next/server/app/icon.png.body
High Semantic Analysis Limited bin/lm-assist.js
High Known Malware Source Similarity core/dist/utils/claudeai-browser-launch.js
High Known Malware Source Similarity core/dist/ui-pages/manager.js
High Known Malware Source Similarity core/dist/cli-runner.js
High Known Malware Source Similarity bin/lm-assist.js
High Known Malware Source Similarity bin/postinstall.js
High Known Malware Source Similarity core/dist/agent-session-store.js
High Known Malware Source Similarity core/dist/hub-client/port-forward-handler.js
High Known Malware Source Similarity core/dist/mcp-server/plugins/client.js
High Known Malware Source Similarity core/dist/memory/autosync.js
High Known Malware Source Similarity core/dist/memory/harvest-daemon.js
High Known Malware Source Similarity core/dist/rest-server.js
High Known Malware Source Similarity core/dist/routes/core/dev-mode.routes.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require core/dist/project-summary-store.js
Medium Install Persistence core/scripts/upgrade.js
Medium Ships Native Binary web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3
Medium Ships Build Helper core/hooks/statusline-worktree.sh
Medium Oversized Source File web/.next/standalone/node_modules/typescript/lib/typescript.js
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Eval web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js
Low Weak Crypto web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js
Runtime surface package.json Entrypoints main → ./core/dist/index.js types → ./core/dist/index.d.ts bin → lm-assist
Runtime node >=20.9.0
Artifact 134 MB · 5,824 files 2 signature(s)
Install lifecycle postinstall prepare prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings PossibleObfuscation UrlStrings CopyleftLicense
34 flagged Lines 74-104 json
75 "puppeteer-core" : "24.43.1" ,
76 "selfsigned" : "^2.4.1" ,
77 "tree-kill" : "^1.2.2" ,
86 "build:core" : "cd core && npm run build" ,
87 "build:web" : "cd web && npm run build" ,
88 "build" : "npm run build:core && npm run build:web" ,
89 "start" : "node bin/lm-assist.js start" ,
90 "stop" : "node bin/lm-assist.js stop" ,
91 "restart" : "node bin/lm-assist.js restart" ,
92 "prepublishOnly" : "npm run build:core" ,
93 "prepare" : "npm run build" ,
94 "postinstall" : "node bin/postinstall.js"
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L94 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L94 97 "global-agent" : "^4.1.2"
101 "registry" : "https://registry.npmjs.org/"
44 Install-time code directly mutates a foreign AI-agent control surface:
L44: "bin",
L45: ".claude-plugin",
L46: ".mcp.json",
L47: "commands",
Write operation from core/dist/utils/install-source.js:
L65: const f = markerFile();
L66: fs.mkdirSync(path.dirname(f), { recursive: true });
L67: const tmp = f + '.tmp';
L68: fs.writeFileSync(tmp, JSON.stringify(rec, null, 2), { mode: 0o600 });
L69: fs.renameSync(tmp, f);
Foreign user/project scope from core/dist/utils/path-utils.js:
L303: * Get the Claude config directory
L304: * Default: ~/.claude
L305: * Can be overridden with CLAUDE_CONFIG_DIR env var
...
L307: function getClaudeConfigDir() {
L308: return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
L309: }
...
L311: * Get the projects directory
L312: * Default: ~/.claude/
Critical Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
package.json View on unpkg · L44 Lines 38-78 javascript
41 Object. defineProperty ( exports , "__esModule" , { value: true });
42 exports .startCore = startCore;
web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js View file 18699 throwingRequire.resolve = moduleRequire.resolve.bind(moduleRequire);
L18700: eval(getModuleCode)(
L18701: module,
Low Eval
Package source references a known benign dynamic code generation pattern.
web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js View on unpkg · L18699 39 };
L40: var __privateIn = (member, obj) => {
L41: if (Object(obj) !== obj)
...
L71:
L72: // ../../node_modules/.pnpm/undici@6.21.0/node_modules/undici/lib/core/symbols.js
L73: var require_symbols = __commonJS({
...
L98: kBodyUsed: Symbol("used"),
L99: kBody: Symbol("abstracted request body"),
L100: kRunning: Symbol("running"),
...
L564: }
L565: const code = this.code = key.charCodeAt(index);
L566: if (code > 127) {
Low Weak Crypto
Package source references weak cryptographic algorithms.
web/.next/standalone/node_modules/next/dist/compiled/@edge-runtime/primitives/load.js View on unpkg · L39 Lines 27-67 javascript
27 var ownKeys = function ( o ) {
28 ownKeys = Object.getOwnPropertyNames || function ( o ) {
Lines 5-45 javascript
6 * Runs detached from the server process. All output is logged to
7 * ~/ .cache / lm - assist / upgrade.log so the frontend can display progress
8 * after the server restarts.
19 const os = require('os');
L20: const http = require('http');
L21: const { loopbackAuthHeader } = require('./lib/loopback-auth');
L22: const { execFileSync } = require('child_process');
L23:
L24: const PORT = process.env.API_PORT || (__dirname.includes('node_modules') ? '3100' : '3200');
L25: const MAP_SCRIPT = path.join(__dirname, 'memory-map.js');
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
core/scripts/memory-reconcile.js View on unpkg · L19 web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js View file 1 (()=>{var __webpack_modules__={462:e=>{e.exports='"use strict";var c=Object.defineProperty,f=Object.getOwnPropertyDescriptor,y=Object.getOwnPropertyNames,S=Object.prototype.hasOwnP...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
web/.next/standalone/node_modules/next/dist/compiled/edge-runtime/index.js View on unpkg · L1 25 Cross-file remote execution chain: bin/lm-assist.js spawns core/dist/backup/config.js; helper contains network access plus dynamic code execution.
L25: try {
L26: const dir = process.env.LM_ASSIST_DATA_DIR || path.join(os.homedir(), '.lm-assist');
L27: const t = fs.readFileSync(path.join(dir, 'api-token'), 'utf8').trim();
...
L54: const cfgPath = path.join(os.homedir(), '.claude-code-config.json');
L55: const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
L56: return {
...
L169:
L170: More info: https://github.com/langmartai/lm-assist
L171: `);
...
L192: fs.copyFileSync(upgradeScript, tmpScript);
L193: const { execFileSync } = require('child_process');
L194: try {
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/lm-assist.js View on unpkg · L25 • stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 82
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
bin/lm-assist.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = bin/lm-assist.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/lm-assist.js core/dist/routes/core/tmux.routes.js View file 52 Trigger-reachable persistence chain: manifest.main -> core/dist/index.js -> core/dist/rest-server.js -> core/dist/routes/index.js -> core/dist/routes/core/index.js -> core/dist/routes/core/tmux.routes.js
L52: const process_utils_1 = require("../../utils/process-utils");
L53: const BASHRC = path.join(os.homedir(), '.bashrc');
L54: const TMUX_CONF = path.join(os.homedir(), '.tmux.conf');
...
L63: const raw = fs.readFileSync(TMUX_CONFIG_FILE, 'utf-8');
L64: const parsed = JSON.parse(raw);
L65: return {
...
L81: try {
L82: const out = (0, exec_1.execFileSync)('tmux', ['-V'], { encoding: 'utf-8', timeout: 5000 }).trim();
L83: installed = true;
...
L139: }
L140: const inTmuxSession = !!process.env.TMUX;
L141: return {
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
core/dist/routes/core/tmux.routes.js View on unpkg · L52 106 try {
L107: execFileSync('npx', ['tsc', '--noEmit'], { cwd: join(REPO, 'core'), encoding: 'utf8', stdio: 'pipe' });
L108: ok.push('typecheck clean (tsc --noEmit)');
High Runtime Package Install
Package source invokes a package manager install command at runtime.
core/scripts/verify-deploy.mjs View on unpkg · L106 web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 View file • path = web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3
kind = native_binary
sizeBytes = 16645008
magicHex = [redacted]
Medium Ships Native Binary
Package ships native binary artifacts.
web/.next/standalone/node_modules/sharp/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.17.3 View on unpkg • path = core/hooks/statusline-worktree.sh
kind = build_helper
sizeBytes = 9173
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
core/hooks/statusline-worktree.sh View on unpkg web/.next/standalone/web/.next/server/app/icon.png.body View file • path = web/.next/standalone/web/.next/server/app/icon.png.body
kind = high_entropy_blob
sizeBytes = 43748
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
web/.next/standalone/web/.next/server/app/icon.png.body View on unpkg • path = web/.next/standalone/web/.next/server/app/icon.png.body
kind = payload_in_excluded_dir
sizeBytes = 43748
magicHex = [redacted]
High Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
web/.next/standalone/web/.next/server/app/icon.png.body View on unpkg web/.next/standalone/node_modules/typescript/lib/typescript.js View file • path = web/.next/standalone/node_modules/typescript/lib/typescript.js
kind = oversized_source_file
sizeBytes = 9112572
magicHex = [redacted]
Medium Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
web/.next/standalone/node_modules/typescript/lib/typescript.js View on unpkg core/dist/utils/claudeai-browser-launch.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/utils/claudeai-browser-launch.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/utils/claudeai-browser-launch.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/ui-pages/manager.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/ui-pages/manager.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/cli-runner.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/cli-runner.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = bin/postinstall.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/postinstall.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/agent-session-store.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/agent-session-store.js View on unpkg core/dist/hub-client/port-forward-handler.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/hub-client/port-forward-handler.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/hub-client/port-forward-handler.js View on unpkg core/dist/mcp-server/plugins/client.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/mcp-server/plugins/client.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/mcp-server/plugins/client.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/memory/autosync.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/memory/autosync.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/memory/harvest-daemon.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/memory/harvest-daemon.js View on unpkg • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/rest-server.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/rest-server.js View on unpkg core/dist/routes/core/dev-mode.routes.js View file • matchType = normalized_sha256
matchedPackage = lm-assist@0.2.4
matchedPath = core/dist/routes/core/dev-mode.routes.js
matchedIdentity = npm:bG0tYXNzaXN0:0.2.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
core/dist/routes/core/dev-mode.routes.js View on unpkg startWeb;
44 exports .startAll = startAll;
45 exports .stopCore = stopCore;
46 exports .stopWeb = stopWeb;
47 exports .stopAll = stopAll;
48 exports .status = status;
49 exports .restartAll = restartAll;
50 exports .getLogPath = getLogPath;
51 exports .readLog = readLog;
52 exports .getComponentInfo = getComponentInfo;
53 exports .getDevConfig = getDevConfig;
54 exports .startDevAll = startDevAll;
55 exports .stopDevAll = stopDevAll;
56 exports .devStatus = devStatus;
57 exports .getDevLogPath = getDevLogPath;
58 exports .readDevLog = readDevLog;
59 const child_process_1 = require ( "child_process" );
60 const fs = __importStar ( require ( "fs" ));
High Child Process
Package source references child process execution.
core/dist/service-manager.js View on unpkg · L58 61 const path = __importStar ( require ( "path" ));
62 const net = __importStar ( require ( "net" ));
63 const os = __importStar ( require ( "os" ));
64 const log_rotate_1 = require ( "./utils/log-rotate" );
65 const tmux_server_guard_1 = require ( "./terminal/tmux-server-guard" );
66 const windows_session_guard_1 = require ( "./windows-session-guard" );
67 // ─── Paths ──────────────────────────────────────────────────
68 const DEFAULT_REPO_ROOT = path. resolve (__dirname, '..' , '..' );
69 function findNpmPackage () {
70 const nodeDir = path. dirname (process.execPath);
72 path. join (nodeDir, 'node_modules' , 'lm-assist' ),
73 path. join (nodeDir, '..' , 'lib' , 'node_modules' , 'lm-assist' ),
75 for ( const candidate of candidates) {
76 if (fs. existsSync (path. join (candidate, 'core' , 'dist' , 'cli.js' ))) {
Lines 185-225 javascript
188 sock. once ( 'timeout' , () => {
192 sock. connect (port, '127.0.0.1' );
196 * The Windows session a SPECIFIC pid runs in. `null` = unknown.
198 * `status` must ask about the RUNNING CORE, not about itself: run over SSH the
199 * CLI always sits in session 0 while Core may be correctly in session 1, so
200 * probing `$PID` there reports the wrong process entirely.
202 function windowsSessionOfPid ( pid ) {
203 if (process.platform !== 'win32' )
206 const out = ( 0 , child_process_1.execFileSync)( 'powershell' , [ '-NoProfile' , '-Command' , `(Get-Process -Id ${ pid } -ErrorAction SilentlyContinue).SessionId` ], { encoding: 'utf8' , timeout: 10_000 , stdio: [ 'ignore' , 'pipe' , 'ignore' ], windowsHide: true });
207 const n = parseInt ( String (out). trim (), 10 );
208 return Number. isInteger (n) ? n : null ;
215 * Probe the Windows session layout in ONE PowerShell call.
217 * Memoized: a process never changes Windows session, and the interactive session
218 * / task registration do not change between a start and its own status line.
220 let winFactsCache = null ;
221 function windowsStartFacts () {
223 return winFactsCache;
224 if (process.platform !== 'win32' ) {
225 winFactsCache = { isWindows: false , mySessionId: null , interactiveSessionId: null , taskName: null };
58 exports.readDevLog = readDevLog;
L59: const child_process_1 = require("child_process");
L60: const fs = __importStar(require("fs"));
L61: const path = __importStar(require("path"));
L62: const net = __importStar(require("net"));
L63: const os = __importStar(require("os"));
...
L67: // ─── Paths ──────────────────────────────────────────────────
L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..');
L69: function findNpmPackage() {
...
L169: return {
L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10),
L171: webPort: cfg?.webPort || parseInt(process.env.WEB_PORT || env.WEB_PORT || defaults.web, 10),
Critical Reverse Shell
Source matches reverse-shell style process and socket wiring.
core/dist/service-manager.js View on unpkg · L58 58 exports.readDevLog = readDevLog;
L59: const child_process_1 = require("child_process");
L60: const fs = __importStar(require("fs"));
L61: const path = __importStar(require("path"));
L62: const net = __importStar(require("net"));
L63: const os = __importStar(require("os"));
...
L67: // ─── Paths ──────────────────────────────────────────────────
L68: const DEFAULT_REPO_ROOT = path.resolve(__dirname, '..', '..');
L69: function findNpmPackage() {
...
L169: return {
L170: apiPort: cfg?.apiPort || parseInt(process.env.API_PORT || env.API_PORT || defaults.api, 10),
L171: webPort: cfg?.webPort || parseInt(process.env.WEB_PORT || env.WEB_PORT || defaults.web, 10),
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
core/dist/service-manager.js View on unpkg · L58 30 for ( var k in o) if ( Object . prototype .hasOwnProperty. call (o, k)) ar[ar. length ] = k;
35 return function ( mod ) {
36 if (mod && mod.__esModule) return mod;
38 if (mod != null ) for ( var k = ownKeys (mod), i = 0 ; i < k. length ; i ++ ) if (k[i] !== "default" ) __createBinding (result, mod, k[i]);
39 __setModuleDefault (result, mod);
43 Object. defineProperty ( exports , "__esModule" , { value: true });
44 exports .getProjectSummary = getProjectSummary;
45 exports .getAllProjectSummaries = getAllProjectSummaries;
46 exports .saveProjectSummary = saveProjectSummary;
47 exports .deleteProjectSummary = deleteProjectSummary;
48 const fs = __importStar ( require ( "fs" ));
49 const path = __importStar ( require ( "path" ));
Medium Dynamic Require
Package source references dynamic require/import behavior.
core/dist/project-summary-store.js View on unpkg · L47 50 const path_utils_1 = require ( "./utils/path-utils" );
51 const STORE_FILE = path. join (( 0 , path_utils_1.getDataDir)(), 'project-summaries.json' );
54 function ensureLoaded () {
57 const stat = fs. statSync ( STORE_FILE );
58 if (stat.mtimeMs !== storeMtime)
66 if (fs. existsSync ( STORE_FILE )) {
67 const data = JSON . parse (fs. readFileSync ( STORE_FILE , 'utf-8' ));
* Usage :
11 * node upgrade.js # install lm - assist@ latest (default)
12 * node upgrade.js -- from < tgz | dir | spec > # install a specific build, e.g. a
13 * # local lm - assist - 0.1 .72.tgz, an
14 * # unpacked dir, a bare version, or any
15 * # npm / git spec. See resolveSource ().
18 * 1. Plugin install (claude plugin install lm - assist@langmartai)
19 * - Skipped for a custom -- from build (plugin always tracks published latest)
20 * 2. Kill all lm - assist processes (services + MCP servers)
21 * 3. npm install - g < source > (default lm - assist@latest)
22 * - Windows EBUSY : tarball + robocopy fallback (uses a local .tgz directly)
26 const { execFileSync } = require ( 'child_process' );
27 const fs = require ( 'fs' );
28 const path = require ( 'path' );
29 const os = require ( 'os' );
31 const isWindows = process.platform === 'win32' ;
32 const isMac = process.platform === 'darwin' ;
34 // ── Log file ────────────────────────────────────────────────────────────────
36 const LOG_DIR = path. join (os. homedir (), '.cache' , 'lm-assist' );
37 const LOG_FILE = path. join ( LOG_DIR , 'upgrade.log' );
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
core/scripts/upgrade.js View on unpkg · L25 39 function ensureLogDir () {
40 if ( ! fs. existsSync ( LOG_DIR )) {
41 fs. mkdirSync ( LOG_DIR , { recursive: true });