Loading npm security reports…

local-operator-ui@0.16.0: Malicious npm security report (Block) | LPM Firewall

registry / local-operator-ui / 0.16.0

local-operator-ui@0.16.0

User interface for AI agent assistants that run Python code safely on your device through an intuitive chat interface. Supports local and cloud LLM models with built-in security features.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Closing the application can terminate unrelated Python workloads. The fallback cleanup matches all Python processes instead of the package's backend alone.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

The Electron application exits while any Python or local-operator process remains.

Impact

Unrelated Python programs can be forcibly terminated, causing lost work or service interruption.

Mechanism

Broad process enumeration followed by force-killing Python processes.

Attack narrative

At runtime, the quit handler lists all python.exe processes on Windows. If any Python or local-operator process remains, it executes an unrestricted taskkill for python.exe; Unix takes an equally broad pkill fallback for python. This is automatic cleanup triggered by closing the app and can terminate unrelated user workloads. Separately, installation automatically invokes Electron's installer and modifies a sandbox helper, but that helper path is package-local and protected against final-component symlinks.

AI rationale

The runtime cleanup contains a concrete broad destructive action that is not limited to package-owned processes. The scanner-addressed comment reinforces malicious intent, while the postinstall behavior alone would not justify blocking.

Evidence

out/main/index.jsnode_modules/electron/install.jsnode_modules/electron/dist/chrome-sandbox

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/local-operator-ui.jsView file

9L10: const { spawn } = require("node:child_process"); L11: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/local-operator-ui.jsView on unpkg · L9

out/main/index.jsView file

1984const { stdout } = await execPromise( L1985: `bash -c "source \\"${shellConfigFile}\\" && env"`, L1986: { shell: "/bin/bash" }

High

Shell

Package source references shell execution.

out/main/index.jsView on unpkg · L1984

•command output transform/external POST = to display error messages and exit\nerror_exit() {\n log "error: $1" >&2\n exit "${2:-1}"\n}\n\n# function to check if python binary is valid for current architecture\nis_valid_python_binary() {\n local python_path="$1"\n \n # first check if file exists and is executable\n if [ ! -f "${python_path}" ] || [ ! -x "${python_path}" ]; then\n return 1\n fi\n \n # try to run a simple python command to verify it works on current architecture\n "${python_path}" -c "print(\'testing python executable\')" >/dev/null 2>&1\n return $?\n}\n\n# check for network connectivity to key servers\ncheck_connectivity() {\n log "checking network connectivity..."\n local servers=("pypi.org" "bootstrap.pypa.io")\n local has_connectivity=false\n \n for serv

High

Fixed External Command Output Exfiltration

Source captures command output, transforms it, and includes it in a POST body sent to a literal external destination.

out/main/index.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = local-operator-ui@0.15.2 matchedIdentity = npm:bG9jYWwtb3BlcmF0b3ItdWk:0.15.2 similarity = 0.872 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/main/index.jsView on unpkg

out/renderer/assets/schedules-page-D4a05UgL.jsView file

8contains invisible/control Unicode U+200E (left-to-right mark) `));return typeof n=="string"?{type:n,contentType:n==="meridiem"?"letter":"digit",maxLength:void 0}:{type:n.sectionType,contentType:n.contentType,maxLength:n.maxLength}},Zo=(e,t)=>{const n=[],o=e.date(void 0,"default"),r=e.startOfWeek(o),s=

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

out/renderer/assets/schedules-page-D4a05UgL.jsView on unpkg · L8

out/renderer/assets/index-D5Z_uzU-.jsView file

•path = out/renderer/assets/index-D5Z_uzU-.js kind = oversized_source_file sizeBytes = 5129700 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/renderer/assets/index-D5Z_uzU-.jsView on unpkg

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

out/renderer/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.5 matchedPath = dist/web/static/assets/sql-D0XecflT.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/renderer/assets/sql-D0XecflT.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 39-79json

39 "electron",

40 "react"

41 ],

42 "files": [

43 "out",

44 "bin",

45 "LICENSE",

46 "README.md"

47 ],

48 "publishConfig": {

49 "access": "public"

50 },

51 "scripts": {

52 "start": "electron-vite preview",

53 "dev": "npx dotenv-cli -e .env -- bash -c 'export $(grep -v '^#' .env | xargs) && electron-vite dev'",

54 "build": "electron-vite build",

55 "prebuild:npm": "rm -rf out/main out/preload",

56 "build:npm": "LOCAL_OPERATOR_UI_NO_BYTECODE=true electron-vite build",

57 "postbuild:npm": "chmod +x ./bin/local-operator-ui.js",

58 "postbuild": "chmod +x ./bin/local-operator-ui.js",

59 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L59

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L59

60 "lint": "pnpm biome check src bin scripts/linux-sandbox.test.mjs",

61 "lint:fix": "pnpm biome check --write src bin scripts/linux-sandbox.test.mjs",

62 "format": "pnpm biome format src",

63 "format:fix": "pnpm biome format --write src",

64 "prepack": "pnpm run build:npm",

65 "check-types:main": "tsc --noEmit -p tsconfig.node.json",

66 "check-types:renderer": "tsc --noEmit -p tsconfig.app.json",

67 "check-types": "pnpm run check-types:main && pnpm run check-types:renderer",

68 "test:desktop": "node --test scripts/linux-sandbox.test.mjs scripts/desktop-contract.test.mjs scripts/transcript-reducer.test.mjs scripts/provider-state.test.mjs scripts/stale-agent.test.mjs scripts/desktop-renderer-transport.test.mjs scripts/provider-grid-error-copy.test.mjs scripts/settings-time-to-error.test.mjs scripts/backend-error-surfaces.test.mjs scripts/canonical-chat.test.mjs",

69 "check-themes": "node scripts/generate-theme-css.mjs --check && node scripts/contrast-contract.mjs",

70 "check-evidence": "node scripts/check-evidence.mjs",

71 "check-edit-diffs": "node scripts/check-edit-diffs.mjs",

72 "gen-themes": "node scripts/generate-theme-css.mjs",

73 "bundle-size": "node scripts/bundle-size.mjs",

74 "startup-closure": "node scripts/startup-closure.mjs",

75 "pack": "pnpm run build && electron-builder --dir",

76 "dist": "pnpm run build && electron-builder",

77 "dist:mac": "pnpm run build && electron-builder --mac --publish never",

78 "dist:win": "pnpm run build && electron-builder --win --publish never",

79 "dist:linux": "pnpm run build && electron-builder --linux --publish never",

bin/local-operator-ui.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2

3/**

4 * Local Operator UI CLI

5 *

6 * This script serves as the entry point for the npx command.

7 * It launches the Electron app.

8 */

9

10const { spawn } = require

out/main/index.jsView file

Lines 1964-2004javascript

1964 const possibleFiles = [

1965 path.join(home, ".bashrc"),

1966 path.join(home, ".zshrc"),

1967 path.join(home, ".profile")

1968

out/renderer/assets/schedules-page-D4a05UgL.jsView file

Lines 1-28javascript

1import{r as d,_ as yi,j as m,$ as vi,a0 as Zc,a1 as Vs,a2 as Wr,K as re,a3 as Jc,a4 as ae,m as St,a5 as So,a6 as Ie,a7 as Bs,a8

out/renderer/assets/index-D5Z_uzU-.jsView file

•path = out/renderer/assets/index-D5Z_uzU-.js kind = oversized_source_file sizeBytes = 5129700 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

out/renderer/assets/index-D5Z_uzU-.jsView on unpkg

bin/linux-sandbox.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/linux-sandbox.js#virtual:normalized:round1View on unpkg

out/renderer/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.4.5 matchedPath = dist/web/static/assets/sql-D0XecflT.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.4.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

out/renderer/assets/sql-D0XecflT.jsView on unpkg