Loading npm security reports…

nelloz@0.48.2: AI-agent control-surface risk | LPM Firewall

registry / nelloz / 0.48.2

nelloz@0.48.2

OMNI main runtime, orchestration, minimal voice UI and model-service manifests

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package downloads and executes a third-party Hermes installer, then initializes Nelloz configuration. This mutates a foreign AI-agent environment without an explicit user command.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during package installation.

Impact

A remote installer gains code execution and can install or configure the Hermes AI agent on the user's machine.

Mechanism

Remote shell-script download and execution followed by automatic initialization.

Policy narrative

During npm installation, the postinstall hook calls ensureHermesInstalled by default. That function fetches a platform-specific installer from hermes-agent.nousresearch.com, writes it to a temporary file, and runs it with bash or PowerShell. The hook then invokes nelloz init, which creates user configuration under the default Nelloz home. This is unconsented install-time execution and setup of a separate AI-agent control surface.

Rationale

The package performs unverified remote code execution during postinstall to install a separate Hermes AI agent. This is a concrete unconsented lifecycle mutation of a foreign AI-agent control surface.

Evidence

package.jsonscripts/postinstall.mjslib/hermes-runtime.mjslib/cli.mjsbin/nelloz.jsdist/payload/config/omni.env.example

Network endpoints2

hermes-agent.nousresearch.com/install.ps1

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

1import { spawnSync } from 'node:child_process'; L2: import process from 'node:process';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L1

lib/hermes-runtime.mjsView file

76return { L77: command: 'powershell.exe', L78: args: [

High

Shell

Package source references shell execution.

lib/hermes-runtime.mjsView on unpkg · L76

1import { spawn, spawnSync } from 'node:child_process'; L2: import { randomUUID } from 'node:crypto'; ... L12: L13: function localHermesHome(env = process.env) { L14: if (clean(env.HERMES_HOME)) return path.resolve(env.HERMES_HOME); L15: if (process.platform === 'win32' && clean(env.LOCALAPPDATA)) { L16: return path.join(env.LOCALAPPDATA, 'hermes'); L17: } L18: return path.join(os.homedir(), '.hermes'); L19: } ... L62: 'Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: ' L63: + 'iex (irm https://hermes-agent.nousresearch.com/install.ps1)',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/hermes-runtime.mjsView on unpkg · L1

dist/payload/frontend/mobile/src/mobile-duplex.tsView file

91duplexRuntimePromise = Promise.all([ L92: import(/* @vite-ignore */ realtimeSessionUrl), L93: import(/* @vite-ignore */ duplexUtilsUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/payload/frontend/mobile/src/mobile-duplex.tsView on unpkg · L91

lib/cli.mjsView file

4Manifest entrypoint (manifest.exports) carries capability families absent from dist/build output: sensitive-file+network, execution+network L4: import process from 'node:process'; L5: import { spawn } from 'node:child_process'; L6: import { startDemoServer } from './demo-server.mjs'; ... L110: function print(value, json) { L111: process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : `${value}\n`); L112: } L113: L114: export function openBrowser(url, { platform = process.platform, spawnImpl = spawn } = {}) { L115: if (!url) return false; L116: const command = platform === 'win32' L117: ? ['cmd.exe', ['/d', '/c', 'start', '', url]] L118: : platform === 'darwin'

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

lib/cli.mjsView on unpkg · L4

lib/hermes-runtime.mjs#virtual:normalized:round1View file

46function probeExecutable(executable) { L47: const result = spawnSync(executable, ["--version"], { L48: encoding: "utf8", ... L55: L56: export function findHermesExecutable(env = process.env) { L57: return executableCandidates(env).find(probeExecutable) || null; ... L61: const error = new Error( L62: "Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: iex (irm https://hermes-agent.nousresearch.com/install.ps1)", L63: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/hermes-runtime.mjs#virtual:normalized:round1View on unpkg · L46

dist/payload/worker.pyView file

•path = dist/payload/worker.py kind = build_helper sizeBytes = 14023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/payload/worker.pyView on unpkg

dist/payload/tests/pipeline/test_desktop_remote_security.pyView file

•path = dist/payload/tests/pipeline/test_desktop_remote_security.py kind = payload_in_excluded_dir sizeBytes = 8676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/payload/tests/pipeline/test_desktop_remote_security.pyView on unpkg

lib/auth.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/auth.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 5-45json

5 "type": "module",

6 "license": "ISC",

7 "bin": {

8 "nelloz": "bin/nelloz.js"

9 },

10 "exports": {

11 ".": "./lib/cli.mjs",

12 "./system-link": "./lib/system-link.mjs"

13 },

14 "files": [

15 "bin",

16 "lib",

17 "scripts",

18 "dist",

19 "README.md",

20 "LICENSE",

21 "THIRD_PARTY_NOTICES.md"

22 ],

23 "scripts": {

24 "build": "node ./scripts/build-payload.mjs",

25 "postinstall": "node ./scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "prepack": "npm run build",

27 "test": "node --test ./test/*.test.mjs"

28 },

29 "engines": {

30 "node": ">=20.11"

31 },

32 "publishConfig": {

33 "access": "public"

34 },

35 "keywords": [

36 "omni",

37 "minicpm",

38 "qwen",

39 "hermes-agent",

40 "multimodal",

41 "local-ai"

42 ],

43 "dependencies": {

44 "ws": "8.21.3"

45 }

scripts/postinstall.mjsView file

Lines 1-21javascript

1import { spawnSync } from 'node:child_process';

2import process from 'node:process';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L1

3import { fileURLToPath } from 'node:url';

4import

lib/hermes-runtime.mjsView file

Lines 1-21javascript

1import { spawn, spawnSync } from 'node:child_process';

2import { randomUUID } from 'node:crypto';

3import { promises as fs } from 'node:fs';

4import os from

dist/payload/frontend/mobile/src/mobile-duplex.tsView file

Lines 71-111typescript

71 },

72) => DuplexSessionLike

73

74type DuplexRuntime = {

75 DuplexSession: DuplexSessionConstructor

76 arrayBufferToBase64: (buffer

lib/cli.mjsView file

Lines 1-24javascript

1import { promises as fs } from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import process from 'node:process'

lib/hermes-runtime.mjs#virtual:normalized:round1View file

46function probeExecutable(executable) { L47: const result = spawnSync(executable, ["--version"], { L48: encoding: "utf8", ... L55: L56: export function findHermesExecutable(env = process.env) { L57: return executableCandidates(env).find(probeExecutable) || null; ... L61: const error = new Error( L62: "Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: iex (irm https://hermes-agent.nousresearch.com/install.ps1)", L63: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/hermes-runtime.mjs#virtual:normalized:round1View on unpkg · L46

dist/payload/worker.pyView file

•path = dist/payload/worker.py kind = build_helper sizeBytes = 14023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/payload/worker.pyView on unpkg

dist/payload/tests/pipeline/test_desktop_remote_security.pyView file

•path = dist/payload/tests/pipeline/test_desktop_remote_security.py kind = payload_in_excluded_dir sizeBytes = 8676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/payload/tests/pipeline/test_desktop_remote_security.pyView on unpkg

lib/auth.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/auth.mjsView on unpkg