nebula-notebook@0.2.92
AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP
AI Security Review
scanned 5d ago · by lpm-firewall-aiServer startup automatically sends a warmup prompt through the user's authenticated Claude CLI, consuming account quota before any autocomplete request. This is an unsolicited use of the user's AI account.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the server when the Claude CLI is available.
Impact
Uses the user's authenticated Claude account and consumes its quota without an explicit request for autocomplete.
Mechanism
Startup prewarming creates a Claude worker, launches the local CLI in print mode, and sends a fixed warmup prompt without waiting for an autocomplete request.
Attack narrative
When the server starts, it checks for a local Claude CLI and prewarms the default backend. Creating a worker launches that CLI in print mode and immediately sends “Reply with exactly: ok.” The package describes this backend as using the user's own CLI and subscription. This spends authenticated account quota before the user requests an autocomplete, so the automatic startup use is malicious under the review rules.
AI rationale
Server startup automatically sends a warmup prompt through the user's authenticated Claude CLI, consuming account quota before any autocomplete request. This is an unsolicited use of the user's AI account.
Evidence
node-server/dist/routes/autocomplete.jsnode_modules/nebula-autocomplete/dist/backends/claude.js
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- The autocomplete service prewarms the default local Claude engine at server startup when the Claude CLI is available.
- The Claude backend launches the CLI in print mode and sends each worker the prompt “Reply with exactly: ok” as a warmup turn.
- The package describes the backend as using the user's own CLI and subscription, so this startup turn uses the user's authenticated AI account before an autocomplete request.
Evidence against
- The postinstall script exits immediately when installed under node_modules.
- The update check requests only the package's latest-version metadata from the npm registry.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/index-pBlQK-xI.jsView file
826patternName = generic_password
severity = medium
line = 826
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/assets/index-pBlQK-xI.jsView on unpkg · L826Findings
6 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/nebula-notebook.js
HighShellnode-server/dist/resources/resource-service.js
HighCross File Remote Execution Contextbin/nebula-notebook.js
HighRuntime Package Installscripts/postinstall.cjs
HighSemantic Analysis Limiteddist/assets/index-BdZ_Kjti.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patterndist/assets/index-pBlQK-xI.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/assets/index-BdZ_Kjti.js
Affected versions and remediation
This report applies to nebula-notebook@0.2.92.
See all versions of nebula-notebook for other recorded verdicts.
- Avoid installing nebula-notebook@0.2.92. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.