registry / nebula-notebook / 0.2.94
nebula-notebook@0.2.94
AI-native notebook computing environment — real Jupyter kernels, real filesystem, built to be driven by agents (Claude Code / Codex) via MCP
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe install hook exits for npm-installed copies and otherwise builds the repository’s own subpackages. Reviewed outbound behavior is limited to a version lookup and cluster registration with a user-configured server; no malicious credential flow was found.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs the postinstall hook; invoking the CLI starts the bundled server and its startup tasks.
Impact
No unconsented collection or unrelated credential transfer was identified in the reviewed paths.
Mechanism
The hook exits from node_modules and otherwise installs/builds local subpackages. Cluster registration uses the configured NEBULA_MAIN_SERVER; the update check fetches the package’s latest version from the npm registry.
AI rationale
The install hook exits for npm-installed copies and otherwise builds the repository’s own subpackages. Reviewed outbound behavior is limited to a version lookup and cluster registration with a user-configured server; no malicious credential flow was found.
Evidence
scripts/postinstall.cjsnode-server/dist/index.jsnode-server/dist/cluster/client-registration.jsnode-server/dist/update-check.js
Network endpoints2
registry.npmjs.orgNEBULA_MAIN_SERVER (user-configured)
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The postinstall script exits when the package is installed under node_modules; otherwise it installs/builds the repository’s subpackages.
- Cluster registration requires client mode and a main server URL from the user’s NEBULA_MAIN_SERVER setting.
- Cluster secrets and allocation tokens are sent to the configured main server as part of registration.
- The startup update check requests only the latest nebula-notebook version from registry.npmjs.org.
Evidence against
- The package defines a postinstall lifecycle script that runs npm install commands in repository subdirectories.
- The launcher starts a local bundled server that supports notebook kernels, filesystem operations, and terminal sessions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinified
Source & flagged code
21 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/assets/index-pBlQK-xI.jsView file
826patternName = generic_password
severity = medium
line = 826
Medium
Secret Pattern
Package contains a possible secret pattern.
dist/assets/index-pBlQK-xI.jsView on unpkg · L826Findings
18 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/nebula-notebook.js
HighShellnode-server/dist/resources/resource-service.js
HighCross File Remote Execution Contextbin/nebula-notebook.js
HighRuntime Package Installscripts/postinstall.cjs
HighSemantic Analysis Limiteddist/assets/index-BdZ_Kjti.js
HighKnown Malware Source Similaritynode-server/dist/index.js
HighKnown Malware Source Similaritynode-server/dist/kernel/default-kernel.js
HighKnown Malware Source Similaritynode-server/dist/terminal/pty-manager.js
HighKnown Malware Source Similaritynode-server/dist/auth/auth-middleware.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to nebula-notebook@0.2.94.
See all versions of nebula-notebook for other recorded verdicts.
- Review the evidence and your use of nebula-notebook@0.2.94 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.