Loading npm security reports…

mobbdev@1.5.18: Malicious npm security report (Block) | LPM Firewall

registry / mobbdev / 1.5.18

mobbdev@1.5.18

Automated secure code remediation tool

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installation fetches an external executable. Explicit hook setup persists global AI-agent hooks that capture context and invoke the latest package release before uploading collected data.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation triggers the binary download; explicit Claude or Windsurf hook setup triggers persistent processing on later agent events.

Impact

Agent transcripts, prompts, inferences, workspace context, and bundled credentials can be exposed; later package releases execute through the persistent hook.

Mechanism

Persistent AI-agent hooks launch latest-package code and upload collected context.

Attack narrative

The package runs a postinstall downloader that places a remote executable in the consumer project. Its explicit hook commands modify global Claude and Windsurf configuration, creating persistent hooks. The Claude hook launches a detached npx mobbdev@latest daemon, so future releases can run automatically. That daemon scans Claude-related context and uploads files, prompts, and inferences to remote upload URLs. The package also ships a production-style environment file containing credential assignments.

Rationale

The package implements concrete persistent agent-data collection and upload behavior, plus a latest-version self-install path and an automatic external binary download. The explicit hook-install command reduces accidental activation but does not remove the demonstrated exfiltration and persistence chain.

Evidence

.envpackage.jsonsrc/post_install/cx_install.mjsdist/index.mjsnode_modules/.bin/cx~/.claude/settings.json~/.mobbdev/daemon-check.js

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/post_install/cx_install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4patternName = blocked_file severity = critical blockedFile = .env redactedSecretContext = secretLikeLines = 5 L4: GITLAB_API_TOKEN=<redacted:0 empty> L5: GITHUB_API_TOKEN=<redacted:0 empty> L6: ADO_TEST_ACCESS_TOKEN=<redacted:0 empty> L7: HASURA_ACCESS_KEY=<redacted:0 empty> L10: DD_RUM_TOKEN=<redacted:35 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

13322// src/utils/computerName.ts L13323: import { execSync } from "child_process"; L13324: import os from "os";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L13322

20212// src/features/claude_code/daemon-check-shim.tmpl.js L20213: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L20214:

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L20212

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs2.writeFileSync(gitignorePath, updatedContent, "utf8"); appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/fix/${fixId}`; appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/issue/${issueId}`; appBaseUrl, appBaseUrl, appBaseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

118Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L119: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L120: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L378: patch L379: patchOriginalEncodingBase64 L380: questions { ... L1144: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1145: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1146: __typename ... L1744: const { url } = sourceCodeFile.signedFile; L1745: const sourceCodeRes = await fetch(url).catch(() => null); L1746: if (!sourceCodeRes?.ok) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.mjsView on unpkg · L118

118Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L119: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L120: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L378: patch L379: patchOriginalEncodingBase64 L380: questions { ... L1144: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1145: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1146: __typename ... L1744: const { url } = sourceCodeFile.signedFile; L1745: const sourceCodeRes = await fetch(url).catch(() => null); L1746: if (!sourceCodeRes?.ok) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.mjsView on unpkg · L118

20212// src/features/claude_code/daemon-check-shim.tmpl.js L20213: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L20214:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L20212

4346const buildPath = "../../../../../[redacted]"; L4347: module = await import(buildPath); L4348: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L4346

11230try { L11231: const getImportMetaUrl = new Function("return import.meta.url"); L11232: const importMetaUrl = getImportMetaUrl();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.mjsView on unpkg · L11230

118Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L119: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L120: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L378: patch L379: patchOriginalEncodingBase64 L380: questions { ... L1144: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1145: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1146: __typename ... L1744: const { url } = sourceCodeFile.signedFile; L1745: const sourceCodeRes = await fetch(url).catch(() => null); L1746: if (!sourceCodeRes?.ok) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L118

dist/hash_search/index.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hash_search/index.mjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "mobbdev",

3 "version": "1.5.18",

4 "description": "Automated secure code remediation tool",

5 "repository": "git+https://github.com/mobb-dev/bugsy.git",

6 "main": "dist/index.mjs",

7 "module": "dist/index.mjs",

8 "scripts": {

9 "clean": "rm -rf build",

10 "env": "dotenv -e ./.env",

11 "postinstall": "node ./src/post_install/cx_install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "build": "tsc && tsup-node --env.NODE_ENV production",

13 "build:dev": "tsup-node --env.NODE_ENV development",

14 "build:binary": "node ./scripts/build_binary.mjs",

15 "build:binary:all": "node ./scripts/build_binary.mjs --all",

16 "increment-version": "./scripts/increment-version.sh",

17 "test:unit:mcp": "vitest run __tests__/mcp/",

18 "test:unit:mcp:ci": "vitest run --bail=1 __tests__/mcp/",

19 "test:mcp:watch": "vitest watch __tests__/mcp/",

20 "test:mcp:verbose": "pnpm run build && NODE_ENV=test VERBOSE=true vitest run __tests__/mcp/",

21 "test:mcp:all": "pnpm run test:unit:mcp && pnpm run test:integration:mcp && pnpm run test:e2e:mcp",

22 "test:unit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

23 "test:unit:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

24 "test:integration": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.test.ts",

25 "test:integration:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.test.ts",

26 "test:integration:baseline-commit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

27 "test:integration:baseline-commit:proxy": "GIT_PROXY_HOST=http://tinyproxy:8888 HTTP_PROXY=http://localhost:8888 API_URL=http://app-api:8080/v1/graphql TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

28 "test:integration:mcp": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

29 "test:integration:mcp:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

30 "test:integration:watch": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest watch run __tests__/integration.test.ts",

31 "test": "pnpm run test:unit && pnpm run test:integration",

Lines 1-10text

1# production@v21

2API_URL="https://api.mobb.ai/v1/graphql"

3WEB_APP_URL="https://app.mobb.ai"

4GITLAB_API_TOKEN=""

5GITHUB_API_TOKEN=""

6ADO_TEST_ACCESS_TOKEN=""

7HASURA_ACCESS_KEY=""

8LOCAL_GRAPHQL_ENDPOINT=""

9GIT_PROXY_HOST="http://tinyproxy:8888"

10DD_RUM_TOKEN="pubf59c0182545bfb4c299175119f1abf9b"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

13322// src/utils/computerName.ts L13323: import { execSync } from "child_process"; L13324: import os from "os";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L13322

20212// src/features/claude_code/daemon-check-shim.tmpl.js L20213: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L20214:

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L20212

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs2.writeFileSync(gitignorePath, updatedContent, "utf8"); appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/fix/${fixId}`; appBaseUrl, return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/issue/${issueId}`; appBaseUrl, appBaseUrl, appBaseUrl,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

118Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L119: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L120: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L378: patch L379: patchOriginalEncodingBase64 L380: questions { ... L1144: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1145: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1146: __typename ... L1744: const { url } = sourceCodeFile.signedFile; L1745: const sourceCodeRes = await fetch(url).catch(() => null); L1746: if (!sourceCodeRes?.ok) {

dist/hash_search/index.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hash_search/index.mjsView on unpkg