registry / Install hook abuse / nelloz

nelloz

OMNI main runtime, orchestration, minimal voice UI and model-service manifests

This report shows the evidence for nelloz@0.48.5. 3 of 7 known versions are blocked or flagged. The newest version, 0.49.3, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The automatic lifecycle hook executes a remotely fetched installer and mutates a foreign AI-agent environment plus user-home and desktop state. This meets the install-hook abuse blocking policy.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall

Impact

An npm install can install and configure an external AI agent and create persistent user-facing launch artifacts without an explicit command.

Mechanism

Remote installer execution and user-home agent setup

Attack narrative

During npm installation, postinstall calls ensureHermesInstalled. If Hermes is absent, the package downloads a shell or PowerShell installer from hermes-agent.nousresearch.com, writes it to a temporary executable file, and runs it. The same hook initializes configuration and secrets in the user's Nelloz home; on Windows it creates a hidden PowerShell launcher and desktop shortcut. These actions occur without an explicit user command.

AI rationale

The automatic lifecycle hook executes a remotely fetched installer and mutates a foreign AI-agent environment plus user-home and desktop state. This meets the install-hook abuse blocking policy.

Evidence

package.jsonscripts/postinstall.mjslib/hermes-runtime.mjslib/cli.mjslib/desktop-app.mjs~/.hermes~/.nelloz%LOCALAPPDATA%/NellozWindows Desktop

Network endpoints1

hermes-agent.nousresearch.com

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares an automatic postinstall hook.
Postinstall downloads and executes an unauthenticated remote Hermes installer.
Postinstall creates Nelloz configuration under the user's home and a hidden Windows desktop launcher.
This is an unconsented install-time mutation of an external AI-agent environment.

Evidence against

No runtime dependency on another release of nelloz was found.
The remote installer is invoked with an explicit argument list rather than a shell string.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 84 file(s), 1.19 MB of source, external domains: 127.0.0.1, api.duckduckgo.com, api.groq.com, api.openai.com, api.stripe.com, app.daytona.io, duckduckgo.com, hermes-agent.nousresearch.com, html.duckduckgo.com, jesucsekcuvtklyidtqn.supabase.co, nelloz.com, nelloz.local

Source & flagged code

24 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/httpx/_urls.pyView file

336patternName = generic_password severity = medium line = 336

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/payload/scripts/daytona/.venv/Lib/site-packages/httpx/_urls.pyView on unpkg · L336

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: import { spawnSync } from 'node:child_process'; L2: import process from 'node:process'; Referenced control path from lib/cli.mjs: L177: }); L178: await fs.writeFile(target, configured, { encoding: 'utf8', mode: 0o600, flag: 'w' }); L179: } Write operation from lib/desktop-app.mjs: L163: : (existsSync(paths.logo) ? await fs.readFile(paths.logo) : null); L164: await fs.writeFile(paths.icon, logoIco || (logoPng ? buildPngIcon(logoPng) : buildNellozIcon())); L165: const commandLine = [process.execPath, paths.cli, 'app', '--home', paths.home] ... L175: ].join('\r\n'); L176: await fs.writeFile(paths.launcher, `\uFEFF${launcherSource}`, { encoding: 'utf8' }); L177: await fs.mkdir(path.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

1import { spawnSync } from 'node:child_process'; L2: import process from 'node:process';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L1

lib/hermes-runtime.mjsView file

76return { L77: command: 'powershell.exe', L78: args: [

High

Shell

Package source references shell execution.

lib/hermes-runtime.mjsView on unpkg · L76

1import { spawn, spawnSync } from 'node:child_process'; L2: import { randomUUID } from 'node:crypto'; ... L12: L13: function localHermesHome(env = process.env) { L14: if (clean(env.HERMES_HOME)) return path.resolve(env.HERMES_HOME); L15: if (process.platform === 'win32' && clean(env.LOCALAPPDATA)) { L16: return path.join(env.LOCALAPPDATA, 'hermes'); L17: } L18: return path.join(os.homedir(), '.hermes'); L19: } ... L62: 'Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: ' L63: + 'iex (irm https://hermes-agent.nousresearch.com/install.ps1)',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/hermes-runtime.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = nelloz@0.48.4 matchedPath = lib/hermes-runtime.mjs matchedIdentity = npm:bmVsbG96:0.48.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hermes-runtime.mjsView on unpkg

dist/payload/frontend/mobile/src/mobile-duplex.tsView file

91duplexRuntimePromise = Promise.all([ L92: import(/* @vite-ignore */ realtimeSessionUrl), L93: import(/* @vite-ignore */ duplexUtilsUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/payload/frontend/mobile/src/mobile-duplex.tsView on unpkg · L91

lib/cli.mjsView file

4Manifest entrypoint (manifest.exports) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L4: import process from 'node:process'; L5: import { spawn } from 'node:child_process'; L6: import { startDemoServer } from './demo-server.mjs'; ... L54: // out of the browser. Explicit process environment variables still win. L55: const localEnvironment = await readEnv(path.resolve(process.cwd(), '.env')); L56: for (const [key, value] of Object.entries(localEnvironment)) { L57: if (!Object.prototype.hasOwnProperty.call(process.env, key)) process.env[key] = value; L58: } ... L121: function print(value, json) { L122: process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : `${value}\n`); L123: } L124:

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

lib/cli.mjsView on unpkg · L4

lib/hermes-runtime.mjs#virtual:normalized:round1View file

46function probeExecutable(executable) { L47: const result = spawnSync(executable, ["--version"], { L48: encoding: "utf8", ... L55: L56: export function findHermesExecutable(env = process.env) { L57: return executableCandidates(env).find(probeExecutable) || null; ... L61: const error = new Error( L62: "Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: iex (irm https://hermes-agent.nousresearch.com/install.ps1)", L63: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/hermes-runtime.mjs#virtual:normalized:round1View on unpkg · L46

dist/payload/scripts/daytona/.venv/Scripts/httpx.exeView file

•path = dist/payload/scripts/daytona/.venv/Scripts/httpx.exe kind = native_binary sizeBytes = 108436 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/payload/scripts/daytona/.venv/Scripts/httpx.exeView on unpkg

dist/payload/worker.pyView file

•path = dist/payload/worker.py kind = build_helper sizeBytes = 14023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/payload/worker.pyView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gzView file

•path = dist/payload/scripts/daytona/.venv/Lib/site-[redacted]-zoneinfo.tar.gz kind = high_entropy_blob sizeBytes = 156400 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gzView on unpkg

•path = dist/payload/scripts/daytona/.venv/Lib/site-[redacted]-zoneinfo.tar.gz kind = compressed_blob sizeBytes = 156400 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gzView on unpkg

dist/payload/tests/pipeline/test_desktop_remote_security.pyView file

•path = dist/payload/tests/pipeline/test_desktop_remote_security.py kind = payload_in_excluded_dir sizeBytes = 8676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/payload/tests/pipeline/test_desktop_remote_security.pyView on unpkg

lib/auth.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/auth.mjsView on unpkg

lib/package-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = nelloz@0.48.4 matchedPath = lib/package-runtime.mjs matchedIdentity = npm:bmVsbG96:0.48.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/package-runtime.mjsView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.pyView file

297patternName = generic_password severity = medium line = 297

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.pyView on unpkg · L297

351patternName = generic_password severity = medium line = 351

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.pyView on unpkg · L351

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.pyView file

297patternName = generic_password severity = medium line = 297

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.pyView on unpkg · L297

351patternName = generic_password severity = medium line = 351

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.pyView on unpkg · L351

dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.pyView file

1820patternName = generic_password severity = medium line = 1820

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.pyView on unpkg · L1820

1847patternName = generic_password severity = medium line = 1847

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.pyView on unpkg · L1847

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/httpx/_urls.pyView file

336patternName = generic_password severity = medium line = 336

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/payload/scripts/daytona/.venv/Lib/site-packages/httpx/_urls.pyView on unpkg · L336

Findings

1 Critical11 High15 Medium4 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/postinstall.mjs

HighShelllib/hermes-runtime.mjs

HighEntrypoint Build Divergencelib/cli.mjs

HighSame File Env Network Executionlib/hermes-runtime.mjs#virtual:normalized:round1

HighSandbox Evasion Gated Capabilitylib/hermes-runtime.mjs

HighShips High Entropy Blobdist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gz

HighPayload In Excluded Dirdist/payload/tests/pipeline/test_desktop_remote_security.py

HighSemantic Analysis Limitedlib/auth.mjs

Affected versions and remediation

This report applies to nelloz@0.48.5.

The versions list below shows the verdict for each recorded version.

Avoid installing nelloz@0.48.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-03 15:36:34.647Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

0.49.3latestSuspicious—WarnPublishedSep 4, 2026, 8:34 AM 0.49.2Suspicious—WarnPublishedSep 4, 2026, 8:28 AM 0.49.1Suspicious—WarnPublishedSep 3, 2026, 9:09 PM 0.48.5shownMaliciousInstall Hook AbuseBlockPublishedSep 1, 2026, 9:05 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other install hook abuse packages

Behavioral surface

Related packages

Other install hook abuse packages

Source & flagged code