registry / Persistence / my-company-device

my-company-device

One-command macOS executor onboarding for Sun Yiting's private company resource pool

This report shows the evidence for my-company-device@0.1.1. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Although it has no automatic npm install hook, the explicitly invoked CLI establishes persistent controller SSH access and prepares remote AI-command execution. The package should be blocked because this is concrete backdoor-style persistence.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the package CLI with its default install command.

Impact

A holder of the matching controller key can gain SSH access if remote login is enabled and can invoke the deployed worker.

Mechanism

Adds a controller SSH key and deploys a restricted remote command worker.

Attack narrative

Running the advertised command installs a fixed SSH public key in the current user's authorized keys file, preserves a device record under the home directory, and deploys a worker that can launch approved AI command-line tools. The installer checks whether SSH is reachable and instructs the user to enable remote login. This is a concrete remote-access persistence mechanism, not merely a local configuration helper.

AI rationale

Evidence

package.jsonscripts/company-device-agent.mjsscripts/device-worker.mjsscripts/device-probe.mjsREADME.md~/.ssh/authorized_keys~/.my-company-device/device.json~/.my-company-device/scripts/device-worker.mjs~/.my-company-device/scripts/device-probe.mjs

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The public CLI installs a fixed controller SSH key into the user's authorized keys file.
It copies worker scripts and writes persistent device configuration under the user's home directory.
It checks for SSH remote login and tells the user to enable it when absent.
The worker accepts requests and launches Codex or Claude with inherited environment variables.
The package description and README frame the tool as onboarding a private company device pool.

Evidence against

The manifest has no preinstall, install, or postinstall hook.
The behavior requires an explicit invocation of the package CLI.
No network request or secret exfiltration code is present in the inspected files.
The worker restricts execution to configured roots and an allowlist of commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

Source & flagged code

4 flagged

scripts/company-device-agent.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

scripts/company-device-agent.mjsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

scripts/company-device-agent.mjsView on unpkg · L1

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/company-device-agent.mjsView on unpkg · L1

4import { homedir, hostname, platform, userInfo } from "node:os";

5import { dirname, join, resolve } from "node:path";

6import { fileURLToPath } from "node:url";

8const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");

9const CONTROLLER_KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILDmyCXjsXvtTUXWidYUmYPig8icVlvV+EvkmE/SQ3DM sunyiting-macmini";

10const args = process.argv.slice(2);

11const command = args[0]?.startsWith("-") ? "install" : (args.shift() || "install");

13function option(name, fallback = "") {

14 const index = args.indexOf(name);

15 return index >= 0 ? String(args[index + 1] || "") : fallback;

16}

18function values(name) {

19 const result = [];

20 for (let index = 0; index < args.length; index += 1) if (args[index] === name && args[index + 1]) result.push(String(args[index + 1]));

21 return result;

Lines 76-111javascript

76 process.exit(2);

77}

78if (platform() !== "darwin") throw new Error("第一阶段安装器只支持 macOS");

79if (Number(process.versions.node.split(

Source & flagged code

4 flagged · loading source

scripts/company-device-agent.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L31: const result = spawnSync("/usr/bin/env", ["which", name], { encoding: "utf8" }); L32: return result.status === 0 ? result.stdout.trim() : ""; L33: } ... L35: function tailscaleIp() { L36: const explicit = option("--ip", process.env.COMPANY_DEVICE_TAILSCALE_IP || ""); L37: if (explicit) return explicit; ... L51: L52: const home = resolve(process.env.COMPANY_DEVICE_HOME || homedir()); L53: const agentRoot = resolve(process.env.COMPANY_DEVICE_AGENT_ROOT || join(home, ".my-company-device"));

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

scripts/company-device-agent.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> scripts/company-device-agent.mjs L1: #!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L31: const result = spawnSync("/usr/bin/env", ["which", name], { encoding: "utf8" }); L32: return result.status === 0 ? result.stdout.trim() : ""; L33: } ... L35: function tailscaleIp() { L36: const explicit = option("--ip", process.env.COMPANY_DEVICE_TAILSCALE_IP || ""); L37: if (explicit) return explicit; ... L51: L52: const home = resolve(process.env.COMPANY_DEVICE_HOME || homedir()); L53: const agentRoot = resolve(process.env.COMPANY_DEVICE_AGENT_ROOT || join(home, ".my-company-device"));

Critical

Findings

2 Critical1 High3 Medium4 Low

CriticalPersistence Backdoorscripts/company-device-agent.mjs

CriticalTrigger Reachable Dangerous Capabilityscripts/company-device-agent.mjs

HighTrigger Reachable Persistencescripts/company-device-agent.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumStripped Provenance Metadatascripts/company-device-agent.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to my-company-device@0.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing my-company-device@0.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 03:00:06.214Z (UTC).

Source advisory published: 2026-09-23 02:43:06.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.1.1latestshownMaliciousPersistenceBlockPublishedAug 28, 2026, 3:53 PM 0.1.0MaliciousMalwareBlockPublishedAug 28, 2026, 3:52 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Behavioral surface

Source & flagged code

Related packages

Other persistence packages