Loading npm security reports…

natureco-cli: Malicious npm security report (Block) | LPM Firewall

registry / natureco-cli / 6.3.1

natureco-cli@6.3.1

Terminal-native AI agent CLI with bilingual TR/EN UI, multi-agent orchestration, persistent memory, secure tools and messaging integrations.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

An explicit migration can create enabled recurring jobs with a hard-coded external WhatsApp recipient. When the gateway runs with WhatsApp connected, generated job replies are delivered to that recipient.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

The user runs natureco migrate, then runs the gateway with WhatsApp connected.

Impact

Content generated from migrated job prompts can be sent to an unrelated external WhatsApp account.

Mechanism

Migrates active jobs into enabled cron entries with a hard-coded fallback delivery target.

Attack narrative

The CLI exposes an explicit migration command. For each active migrated OpenClaw cron job, it defaults WhatsApp delivery to a hard-coded phone number if the user has no configured number and saves the job as enabled. The gateway later schedules those jobs, submits their prompt to the configured AI provider, and sends the resulting reply to that WhatsApp recipient. This creates an external data-delivery path unrelated to the user’s configured destination.

AI rationale

The hard-coded fallback recipient, automatic enabling of migrated jobs, and later outbound delivery establish a concrete exfiltration path. The lack of an npm install hook does not remove this malicious runtime behavior.

Evidence

bin/natureco.jssrc/commands/migrate.jssrc/commands/gateway-server.js~/.natureco/crons.json

Network endpoints1

s.whatsapp.net

Source & flagged code

14 flagged · loading source

src/tools/bash.jsView file

1const { execSync } = require('child_process'); L2: const os = require('os');

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L1

src/commands/policy.jsView file

92const { execSync } = require('child_process'); L93: const output = execSync(`powershell -Command "Get-PSDrive -Name ${drive} | Select-Object -ExpandProperty Free"`, { encoding: 'utf-8' }).trim(); L94: const free = parseInt(output);

High

Shell

Package source references shell execution.

src/commands/policy.jsView on unpkg · L92

bin/natureco.jsView file

5if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[2] === '-V')) { L6: process.stdout.write(require('../package.json').version + '\n'); L7: process.exit(0);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/natureco.jsView on unpkg · L5

src/commands/gateway-server.jsView file

4const os = require('os'); L5: const { spawn, execSync, execFileSync } = require('child_process'); L6: const pino = require('pino'); ... L14: L15: const PID_FILE = path.join(os.homedir(), '.natureco', 'gateway.pid'); L16: const LOG_FILE = path.join(os.homedir(), '.natureco', 'gateway.log'); ... L71: if (!global.discordClient) throw new Error('Discord not connected'); L72: const channel = await global.discordClient.channels.fetch(String(item.target)); L73: return channel.send(String(item.payload.message)); L74: }, async () => ({ ok: !!global.discordClient })); ... L146: L147: // Note: File writing removed - parent process redirects stdout/stderr to log file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/commands/gateway-server.jsView on unpkg · L4

src/tools/cron_create.jsView file

10const os = require("os"); L11: const { execSync } = require("child_process"); L12: L13: const CRON_FILE = path.join(os.homedir(), ".natureco", "crons.json"); L14: ... L17: if (!fs.existsSync(CRON_FILE)) return []; L18: return JSON.parse(fs.readFileSync(CRON_FILE, "utf8")); L19: } catch { return []; } ... L42: L43: async function createCron({ name, schedule, command, description = "", allowSystemCrontab = false, agentId = "default" }) { L44: if (!name) return { success: false, error: "name gerekli" };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/tools/cron_create.jsView on unpkg · L10

src/tools/voice_chat.jsView file

15const path = require("path"); L16: const { spawn } = require("child_process"); L17: const https = require("https"); L18: ... L25: return new Promise((resolve, reject) => { L26: const apiKey = process.env.OPENAI_API_KEY || process.env.WHISPER_API_KEY; L27: if (!apiKey) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/tools/voice_chat.jsView on unpkg · L15

src/utils/channel-runtime.jsView file

71try { L72: const res = await fetch(`${homeserver}/_matrix/client/v3/account/whoami`, { L73: headers: { Authorization: `Bearer ${token}` }, ... L79: } L80: userId = (await res.json()).user_id || userId; L81: } catch (error) { ... L151: headers: { Authorization: `Bearer ${config.matrixToken}`, 'Content-Type': 'application/json' }, L152: body: JSON.stringify({ msgtype: 'm.text', body: String(message) }), L153: signal: AbortSignal.timeout(15000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/utils/channel-runtime.jsView on unpkg · L71

71Trigger-reachable chain: manifest.bin -> bin/natureco.js -> src/commands/gateway-server.js -> src/utils/channel-runtime.js L71: try { L72: const res = await fetch(`${homeserver}/_matrix/client/v3/account/whoami`, { L73: headers: { Authorization: `Bearer ${token}` }, ... L79: } L80: userId = (await res.json()).user_id || userId; L81: } catch (error) { ... L151: headers: { Authorization: `Bearer ${config.matrixToken}`, 'Content-Type': 'application/json' }, L152: body: JSON.stringify({ msgtype: 'm.text', body: String(message) }), L153: signal: AbortSignal.timeout(15000),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/utils/channel-runtime.jsView on unpkg · L71

src/tools/phone_control_enhanced.jsView file

1const { getConfig, saveConfig } = require('../utils/config'); L2: const { execFileSync } = require('child_process'); L3: ... L56: if (service === 'pushover') { L57: const token = config.pushoverToken || process.env.PUSHOVER_TOKEN; L58: const user = config.pushoverUser || process.env.PUSHOVER_USER; L59: if (!token || !user) return { success: false, error: 'Pushover token/user gerekli' }; L60: const r = await fetch('https://api.pushover.net/1/messages.json', { L61: method: 'POST', L62: headers: { 'Content-Type': 'application/json' }, L63: body: JSON.stringify({ token, user, title: params.title || 'NatureCo', message: params.message, priority: params.priority || 0 }) L64: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/phone_control_enhanced.jsView on unpkg · L1

src/tools/youtube_ac.jsView file

4L5: const { spawn, execFileSync } = require("child_process"); L6: const os = require("os"); ... L30: function isUrl(str) { L31: return str.startsWith("http://") || str.startsWith("https://"); L32: } ... L64: ? spawn("open", browser ? ["-a", browser, youtubeUrl] : [youtubeUrl]) L65: : process.platform === "win32" L66: ? spawn("cmd", ["/c", "start", "", youtubeUrl], { windowsHide: true })

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/youtube_ac.jsView on unpkg · L4

src/commands/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. f migrate edildi', 'active migrated')}, ${report.crons.inactive} ${l('pasif atlandı', 'inactive skipped')})`)); } if (report.telegram && report.telegram.length > 0) { console.log(chalk.green('✅ telegram allowfrom:'), chalk.white(report.telegram.join(', '))); } else if (report.telegram !== null) { console.log(chalk.gray(l('⚠️ telegram allowfrom: bulunamadı', '⚠️ telegram allowfrom: not found'))); } if (report.whatsapp) { console.log(chalk.green(l('✅ whatsapp session kopyalandı', '✅ whatsapp session copied'))); } console.log(''); console.log(chalk.yellow(l('⚠️ manuel kurulum gerekli:', '⚠️ manual setup required:'))); consol

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/commands/migrate.jsView on unpkg

src/commands/update.jsView file

142try { L143: execSync('npm install -g natureco-cli@latest', { stdio: 'inherit' }); L144: saveVersion({ installed: latest, updated: new Date().toISOString(), latest });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L142

bin/natureco.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/natureco.js#virtual:normalized:round1View on unpkg

src/commands/code_v5.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = natureco-cli@6.2.1 matchedIdentity = npm:bmF0dXJlY28tY2xp:6.2.1 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/code_v5.jsView on unpkg

Source & flagged code

14 flagged

src/tools/bash.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const os = require('os');

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L1

3const chalk = require('chalk');

4const { isDangerousCommand, checkCommand, isSafeCommand } = require('../utils/approvals');

5

6module.exports = {

7 name: 'bash',

8 description: 'Execute bash commands in the terminal',

9 inputSchema: {

10 type: 'object',

11 properties: {

12 command: {

13 type: 'string',

14 description: 'The bash command to execute'

15 }

16 },

17 required: ['command']

18 },

19

20 async execute(params) {

21 try {

src/commands/policy.jsView file

Lines 72-112javascript

72 id: 'git-config',

73 name: L('Git Yapılandırması', 'Git Configuration'),

74 check: () => {

75 try {

76

bin/natureco.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2

3// Fast path: version checks are used by shells, installers and health probes.

4// Avoid loading Commander and ~100 command modules for a constant-time answer.

5if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[2

src/commands/gateway-server.jsView file

Lines 1-24javascript

1const chalk = require('chalk');

2const fs = require('fs');

3const path = require

src/tools/cron_create.jsView file

Lines 1-30javascript

1/**

2 * cron_create - Zamanlanmis gorev (v4.9.0)

3 *

4 * Hermes cronjob'una benzer. "Her gun 09:00'da calistir" gibi.

5 * NatureCo CLI mevcut cron sistemine yazar (cron.js zaten var).

6 */

7

8const fs = require("fs");

src/tools/voice_chat.jsView file

Lines 1-35javascript

1/**

2 * voice_chat - Sesli asistan (v5.3.0)

3 *

4 * Voice chat — sesli iletisim

5 *

6 * Mikrofon → Whisper STT → REPL'e metin olarak gönder

7 * Bot cevabı → TTS ile sesli oku

8 *

9 * macOS icin: afplay + sox/rec + Whisper

10 * Cross-platform: openai-whisper API veya local whisper.cpp

11 */

src/utils/channel-runtime.jsView file

Lines 51-91javascript

51 message,

52 `${channel}_${chatKey}`,

53 `You are a helpful ${channel} assistant. Keep responses concise.`,

54 { noTools: true },

55 );

56 return

src/tools/phone_control_enhanced.jsView file

Lines 1-21javascript

1const { getConfig, saveConfig } = require('../utils/config');

2const { execFileSync } = require('child_process');

3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/youtube_ac.jsView file

4L5: const { spawn, execFileSync } = require("child_process"); L6: const os = require("os"); ... L30: function isUrl(str) { L31: return str.startsWith("http://") || str.startsWith("https://"); L32: } ... L64: ? spawn("open", browser ? ["-a", browser, youtubeUrl] : [youtubeUrl]) L65: : process.platform === "win32" L66: ? spawn("cmd", ["/c", "start", "", youtubeUrl], { windowsHide: true })

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/youtube_ac.jsView on unpkg · L4

src/commands/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. f migrate edildi', 'active migrated')}, ${report.crons.inactive} ${l('pasif atlandı', 'inactive skipped')})`)); } if (report.telegram && report.telegram.length > 0) { console.log(chalk.green('✅ telegram allowfrom:'), chalk.white(report.telegram.join(', '))); } else if (report.telegram !== null) { console.log(chalk.gray(l('⚠️ telegram allowfrom: bulunamadı', '⚠️ telegram allowfrom: not found'))); } if (report.whatsapp) { console.log(chalk.green(l('✅ whatsapp session kopyalandı', '✅ whatsapp session copied'))); } console.log(''); console.log(chalk.yellow(l('⚠️ manuel kurulum gerekli:', '⚠️ manual setup required:'))); consol

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/commands/migrate.jsView on unpkg

src/commands/update.jsView file

142try { L143: execSync('npm install -g natureco-cli@latest', { stdio: 'inherit' }); L144: saveVersion({ installed: latest, updated: new Date().toISOString(), latest });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L142

bin/natureco.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/natureco.js#virtual:normalized:round1View on unpkg

src/commands/code_v5.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = natureco-cli@6.2.1 matchedIdentity = npm:bmF0dXJlY28tY2xp:6.2.1 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/code_v5.jsView on unpkg