registry / natureco-cli / 6.2.1

natureco-cli@6.2.1

Terminal-native AI agent CLI with bilingual TR/EN UI, multi-agent orchestration, persistent memory, secure tools and messaging integrations.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The user runs natureco migrate.

Impact

Imported credentials and jobs may become available to the new CLI and its enabled automation.

Mechanism

Imports another agent's secrets, sessions, and scheduled jobs into NatureCo storage.

AI rationale

The package has a risky explicit migration capability that handles credentials, persistent automation, and dependency installation. It lacks an install lifecycle hook and no confirmed package-controlled exfiltration was found, so blocking as malware is not justified.

Evidence

bin/natureco.jssrc/commands/migrate.jssrc/tools/phone_control_enhanced.jspackage.json~/.openclaw/workspace/scripts/.env~/.openclaw/.env~/.openclaw/credentials/whatsapp/default~/.natureco/workspace/scripts/.env~/.natureco/whatsapp-sessions/~/.natureco/crons.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The explicit migration command copies an OpenClaw .env file and then runs npm install in the new workspace.
Migration copies a WhatsApp credential-session directory into NatureCo storage.
Migration converts imported jobs into enabled persistent cron entries.
The notification tool sends supplied notification content and configured Pushover credentials to Pushover.
The manifest has only a prepublish hook, not an install-time lifecycle hook.

Evidence against

The risky migration path is registered as an explicit CLI command rather than an install hook.
No source inspected showed collection and transmission of arbitrary local secrets to a package-controlled endpoint.
The Pushover request uses the configured notification service and caller-provided message.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 333 file(s), 2.50 MB of source, external domains: 127.0.0.1, accounts.spotify.com, api.anthropic.com, api.botframework.com, api.browser-use.com, api.cohere.ai, api.deepgram.com, api.deepinfra.com, api.deepseek.com, api.duckduckgo.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.firecrawl.dev, api.fireworks.ai, api.github.com, api.groq.com, api.medium.com, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.natureco.me, api.openai.com, api.perplexity.ai, api.pushover.net, api.runwayml.com, api.sunoa.ai, api.tavily.com, api.together.xyz, api.twilio.com, api.twitter.com, api.udio.ai, api.vydra.ai, api.x.ai, api.z.ai, browser-use.com, chat.googleapis.com, clawhub.ai, cloud.browser-use.com, console.anthropic.com, console.deepgram.com, console.groq.com, console.mistral.ai, dashboard.exa.ai, developers.deepgram.com, developers.natureco.me, docs.anthropic.com, docs.mistral.ai

Source & flagged code

13 flagged

src/tools/bash.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

2const os = require('os');

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L1

3const chalk = require('chalk');

4const { isDangerousCommand, checkCommand, isSafeCommand } = require('../utils/approvals');

6module.exports = {

7 name: 'bash',

8 description: 'Execute bash commands in the terminal',

9 inputSchema: {

10 type: 'object',

11 properties: {

12 command: {

13 type: 'string',

14 description: 'The bash command to execute'

15 }

16 },

17 required: ['command']

18 },

20 async execute(params) {

21 try {

src/commands/policy.jsView file

Lines 72-112javascript

72 id: 'git-config',

73 name: L('Git Yapılandırması', 'Git Configuration'),

74 check: () => {

75 try {

bin/natureco.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3// Fast path: version checks are used by shells, installers and health probes.

4// Avoid loading Commander and ~100 command modules for a constant-time answer.

5if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[2

src/commands/gateway-server.jsView file

Lines 1-24javascript

1const chalk = require('chalk');

2const fs = require('fs');

3const path = require

src/tools/cron_create.jsView file

Lines 1-30javascript

1/**

2 * cron_create - Zamanlanmis gorev (v4.9.0)

3 *

4 * Hermes cronjob'una benzer. "Her gun 09:00'da calistir" gibi.

5 * NatureCo CLI mevcut cron sistemine yazar (cron.js zaten var).

6 */

8const fs = require("fs");

src/tools/voice_chat.jsView file

Lines 1-35javascript

1/**

2 * voice_chat - Sesli asistan (v5.3.0)

3 *

4 * Voice chat — sesli iletisim

5 *

6 * Mikrofon → Whisper STT → REPL'e metin olarak gönder

7 * Bot cevabı → TTS ile sesli oku

8 *

9 * macOS icin: afplay + sox/rec + Whisper

10 * Cross-platform: openai-whisper API veya local whisper.cpp

11 */

src/utils/channel-runtime.jsView file

Lines 51-91javascript

51 message,

52 `${channel}_${chatKey}`,

53 `You are a helpful ${channel} assistant. Keep responses concise.`,

54 { noTools: true },

55 );

56 return

src/tools/phone_control_enhanced.jsView file

Lines 1-21javascript

1const { getConfig, saveConfig } = require('../utils/config');

2const { execFileSync } = require('child_process');

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/youtube_ac.jsView file

4L5: const { spawn, execFileSync } = require("child_process"); L6: const os = require("os"); ... L30: function isUrl(str) { L31: return str.startsWith("http://") || str.startsWith("https://"); L32: } ... L64: ? spawn("open", browser ? ["-a", browser, youtubeUrl] : [youtubeUrl]) L65: : process.platform === "win32" L66: ? spawn("cmd", ["/c", "start", "", youtubeUrl], { windowsHide: true })

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/youtube_ac.jsView on unpkg · L4

src/commands/migrate.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. f migrate edildi', 'active migrated')}, ${report.crons.inactive} ${l('pasif atlandı', 'inactive skipped')})`)); } if (report.telegram && report.telegram.length > 0) { console.log(chalk.green('✅ telegram allowfrom:'), chalk.white(report.telegram.join(', '))); } else if (report.telegram !== null) { console.log(chalk.gray(l('⚠️ telegram allowfrom: bulunamadı', '⚠️ telegram allowfrom: not found'))); } if (report.whatsapp) { console.log(chalk.green(l('✅ whatsapp session kopyalandı', '✅ whatsapp session copied'))); } console.log(''); console.log(chalk.yellow(l('⚠️ manuel kurulum gerekli:', '⚠️ manual setup required:'))); consol

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/commands/migrate.jsView on unpkg

src/commands/update.jsView file

137try { L138: execSync('npm install -g natureco-cli@latest', { stdio: 'inherit' }); L139: saveVersion({ installed: latest, updated: new Date().toISOString(), latest });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L137

bin/natureco.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/natureco.js#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged · loading source

src/tools/bash.jsView file

1const { execSync } = require('child_process'); L2: const os = require('os');

High

Child Process

Package source references child process execution.

src/tools/bash.jsView on unpkg · L1

src/commands/policy.jsView file

92const { execSync } = require('child_process'); L93: const output = execSync(`powershell -Command "Get-PSDrive -Name ${drive} | Select-Object -ExpandProperty Free"`, { encoding: 'utf-8' }).trim(); L94: const free = parseInt(output);

High

Shell

Package source references shell execution.

src/commands/policy.jsView on unpkg · L92

bin/natureco.jsView file

5if (process.argv.length === 3 && (process.argv[2] === '--version' || process.argv[2] === '-V')) { L6: process.stdout.write(require('../package.json').version + '\n'); L7: process.exit(0);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/natureco.jsView on unpkg · L5

src/commands/gateway-server.jsView file

4const os = require('os'); L5: const { spawn, execSync, execFileSync } = require('child_process'); L6: const pino = require('pino'); ... L14: L15: const PID_FILE = path.join(os.homedir(), '.natureco', 'gateway.pid'); L16: const LOG_FILE = path.join(os.homedir(), '.natureco', 'gateway.log'); ... L71: if (!global.discordClient) throw new Error('Discord not connected'); L72: const channel = await global.discordClient.channels.fetch(String(item.target)); L73: return channel.send(String(item.payload.message)); L74: }, async () => ({ ok: !!global.discordClient })); ... L146: L147: // Note: File writing removed - parent process redirects stdout/stderr to log file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/commands/gateway-server.jsView on unpkg · L4

src/tools/cron_create.jsView file

10const os = require("os"); L11: const { execSync } = require("child_process"); L12: L13: const CRON_FILE = path.join(os.homedir(), ".natureco", "crons.json"); L14: ... L17: if (!fs.existsSync(CRON_FILE)) return []; L18: return JSON.parse(fs.readFileSync(CRON_FILE, "utf8")); L19: } catch { return []; } ... L42: L43: async function createCron({ name, schedule, command, description = "", allowSystemCrontab = false, agentId = "default" }) { L44: if (!name) return { success: false, error: "name gerekli" };

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/tools/cron_create.jsView on unpkg · L10

src/tools/voice_chat.jsView file

15const path = require("path"); L16: const { spawn } = require("child_process"); L17: const https = require("https"); L18: ... L25: return new Promise((resolve, reject) => { L26: const apiKey = process.env.OPENAI_API_KEY || process.env.WHISPER_API_KEY; L27: if (!apiKey) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/tools/voice_chat.jsView on unpkg · L15

src/utils/channel-runtime.jsView file

71try { L72: const res = await fetch(`${homeserver}/_matrix/client/v3/account/whoami`, { L73: headers: { Authorization: `Bearer ${token}` }, ... L79: } L80: userId = (await res.json()).user_id || userId; L81: } catch (error) { ... L151: headers: { Authorization: `Bearer ${config.matrixToken}`, 'Content-Type': 'application/json' }, L152: body: JSON.stringify({ msgtype: 'm.text', body: String(message) }), L153: signal: AbortSignal.timeout(15000),

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/utils/channel-runtime.jsView on unpkg · L71

71Trigger-reachable chain: manifest.bin -> bin/natureco.js -> src/commands/gateway-server.js -> src/utils/channel-runtime.js L71: try { L72: const res = await fetch(`${homeserver}/_matrix/client/v3/account/whoami`, { L73: headers: { Authorization: `Bearer ${token}` }, ... L79: } L80: userId = (await res.json()).user_id || userId; L81: } catch (error) { ... L151: headers: { Authorization: `Bearer ${config.matrixToken}`, 'Content-Type': 'application/json' }, L152: body: JSON.stringify({ msgtype: 'm.text', body: String(message) }), L153: signal: AbortSignal.timeout(15000),

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/utils/channel-runtime.jsView on unpkg · L71

src/tools/phone_control_enhanced.jsView file

1const { getConfig, saveConfig } = require('../utils/config'); L2: const { execFileSync } = require('child_process'); L3: ... L56: if (service === 'pushover') { L57: const token = config.pushoverToken || process.env.PUSHOVER_TOKEN; L58: const user = config.pushoverUser || process.env.PUSHOVER_USER; L59: if (!token || !user) return { success: false, error: 'Pushover token/user gerekli' }; L60: const r = await fetch('https://api.pushover.net/1/messages.json', { L61: method: 'POST', L62: headers: { 'Content-Type': 'application/json' }, L63: body: JSON.stringify({ token, user, title: params.title || 'NatureCo', message: params.message, priority: params.priority || 0 }) L64: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/tools/phone_control_enhanced.jsView on unpkg · L1

src/tools/youtube_ac.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/tools/youtube_ac.jsView on unpkg · L4

src/commands/migrate.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/commands/migrate.jsView on unpkg

src/commands/update.jsView file

137try { L138: execSync('npm install -g natureco-cli@latest', { stdio: 'inherit' }); L139: saveVersion({ installed: latest, updated: new Date().toISOString(), latest });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/update.jsView on unpkg · L137

bin/natureco.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/natureco.js#virtual:normalized:round1View on unpkg

Findings

3 Critical7 High6 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationsrc/utils/channel-runtime.js

CriticalCredential Exfiltrationsrc/tools/phone_control_enhanced.js

CriticalTrigger Reachable Dangerous Capabilitysrc/utils/channel-runtime.js

HighChild Processsrc/tools/bash.js

HighShellsrc/commands/policy.js

HighSame File Env Network Executionsrc/tools/voice_chat.js

HighSandbox Evasion Gated Capabilitysrc/tools/youtube_ac.js

HighTrigger Reachable External Ai Agent Control Surface Mutationsrc/commands/migrate.js

HighRuntime Package Installsrc/commands/update.js

HighSemantic Analysis Limitedbin/natureco.js#virtual:normalized:round1

MediumDynamic Requirebin/natureco.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/tools/cron_create.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/commands/gateway-server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to natureco-cli@6.2.1.

See version security history for other recorded verdicts.

Review the evidence and your use of natureco-cli@6.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-01 20:07:31.529Z (UTC).