Loading npm security reports…

nelloz@0.48.4: Malicious npm security report (Block) | LPM Firewall

registry / nelloz / 0.48.4

nelloz@0.48.4

OMNI main runtime, orchestration, minimal voice UI and model-service manifests

AI Security Review

scanned 2h ago · by lpm-firewall-ai

npm installation automatically downloads and executes a remote installer, then initializes files in the user's Nelloz home. The remote script is not pinned or integrity-verified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with lifecycle scripts enabled.

Impact

A package install can execute attacker-controlled code from the remote installer and modify user configuration outside the project.

Mechanism

Postinstall remote-script download and execution followed by automatic home-directory initialization.

Attack narrative

During npm postinstall, the package calls its Hermes bootstrap routine by default. That routine downloads a platform-specific script from hermes-agent.nousresearch.com, stores it as an executable temporary file, and runs it with Bash or PowerShell. The same lifecycle hook then invokes init, which creates and writes a Nelloz configuration tree outside the package. This creates an unconsented remote code execution path at install time.

Rationale

This is concrete install-hook abuse: an automatic lifecycle hook fetches and executes unpinned remote code and modifies user-home configuration. The opt-out variable does not establish user consent because the risky behavior is the default.

Evidence

package.jsonscripts/postinstall.mjslib/hermes-runtime.mjslib/cli.mjsbin/nelloz.js

Network endpoints2

hermes-agent.nousresearch.com/install.ps1

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/httpx/_urls.pyView file

336patternName = generic_password severity = medium line = 336

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/payload/scripts/daytona/.venv/Lib/site-packages/httpx/_urls.pyView on unpkg · L336

scripts/postinstall.mjsView file

1Install-time AI-agent control hijack evidence: Install-time helper chain writes an AI-agent control surface: L1: import { spawnSync } from 'node:child_process'; L2: import process from 'node:process'; Referenced control path from lib/cli.mjs: L175: }); L176: await fs.writeFile(target, configured, { encoding: 'utf8', mode: 0o600, flag: 'w' }); L177: } Write operation from lib/hermes-runtime.mjs: L104: if (installer.byteLength < 1_000) throw new Error('Der geladene Hermes-Installer ist unvollständig.'); L105: await fs.writeFile(installerPath, installer, { mode: 0o700 }); L106: ... L162: await fs.mkdir(home, { recursive: true }); L163: await fs.writeFile(target, upsertEnv(raw, { L164: OPENAI_API_KEY: secret, Payload evidence from dist/payload/docs/skills/ios-scroll-fix.md: L1: # iOS 触控滚动修复（全

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

1import { spawnSync } from 'node:child_process'; L2: import process from 'node:process';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L1

lib/hermes-runtime.mjsView file

76return { L77: command: 'powershell.exe', L78: args: [

High

Shell

Package source references shell execution.

lib/hermes-runtime.mjsView on unpkg · L76

1import { spawn, spawnSync } from 'node:child_process'; L2: import { randomUUID } from 'node:crypto'; ... L12: L13: function localHermesHome(env = process.env) { L14: if (clean(env.HERMES_HOME)) return path.resolve(env.HERMES_HOME); L15: if (process.platform === 'win32' && clean(env.LOCALAPPDATA)) { L16: return path.join(env.LOCALAPPDATA, 'hermes'); L17: } L18: return path.join(os.homedir(), '.hermes'); L19: } ... L62: 'Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: ' L63: + 'iex (irm https://hermes-agent.nousresearch.com/install.ps1)',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/hermes-runtime.mjsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = nelloz@0.48.2 matchedPath = lib/hermes-runtime.mjs matchedIdentity = npm:bmVsbG96:0.48.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/hermes-runtime.mjsView on unpkg

dist/payload/frontend/mobile/src/mobile-duplex.tsView file

91duplexRuntimePromise = Promise.all([ L92: import(/* @vite-ignore */ realtimeSessionUrl), L93: import(/* @vite-ignore */ duplexUtilsUrl),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/payload/frontend/mobile/src/mobile-duplex.tsView on unpkg · L91

lib/cli.mjsView file

4Manifest entrypoint (manifest.exports) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L4: import process from 'node:process'; L5: import { spawn } from 'node:child_process'; L6: import { startDemoServer } from './demo-server.mjs'; ... L53: // out of the browser. Explicit process environment variables still win. L54: const localEnvironment = await readEnv(path.resolve(process.cwd(), '.env')); L55: for (const [key, value] of Object.entries(localEnvironment)) { L56: if (!Object.prototype.hasOwnProperty.call(process.env, key)) process.env[key] = value; L57: } ... L119: function print(value, json) { L120: process.stdout.write(json ? `${JSON.stringify(value, null, 2)}\n` : `${value}\n`); L121: } L122:

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

lib/cli.mjsView on unpkg · L4

lib/hermes-runtime.mjs#virtual:normalized:round1View file

46function probeExecutable(executable) { L47: const result = spawnSync(executable, ["--version"], { L48: encoding: "utf8", ... L55: L56: export function findHermesExecutable(env = process.env) { L57: return executableCandidates(env).find(probeExecutable) || null; ... L61: const error = new Error( L62: "Hermes Agent ist nicht installiert. Installiere ihn unter Windows mit: iex (irm https://hermes-agent.nousresearch.com/install.ps1)", L63: );

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/hermes-runtime.mjs#virtual:normalized:round1View on unpkg · L46

dist/payload/scripts/daytona/.venv/Scripts/httpx.exeView file

•path = dist/payload/scripts/daytona/.venv/Scripts/httpx.exe kind = native_binary sizeBytes = 108436 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/payload/scripts/daytona/.venv/Scripts/httpx.exeView on unpkg

dist/payload/worker.pyView file

•path = dist/payload/worker.py kind = build_helper sizeBytes = 14023 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/payload/worker.pyView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gzView file

•path = dist/payload/scripts/daytona/.venv/Lib/site-[redacted]-zoneinfo.tar.gz kind = high_entropy_blob sizeBytes = 156400 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gzView on unpkg

•path = dist/payload/scripts/daytona/.venv/Lib/site-[redacted]-zoneinfo.tar.gz kind = compressed_blob sizeBytes = 156400 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/payload/scripts/daytona/.venv/Lib/site-packages/dateutil/zoneinfo/dateutil-zoneinfo.tar.gzView on unpkg

dist/payload/tests/pipeline/test_desktop_remote_security.pyView file

•path = dist/payload/tests/pipeline/test_desktop_remote_security.py kind = payload_in_excluded_dir sizeBytes = 8676 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/payload/tests/pipeline/test_desktop_remote_security.pyView on unpkg

lib/auth.mjsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/auth.mjsView on unpkg

lib/package-runtime.mjsView file

•matchType = normalized_sha256 matchedPackage = nelloz@0.48.2 matchedPath = lib/package-runtime.mjs matchedIdentity = npm:bmVsbG96:0.48.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/package-runtime.mjsView on unpkg

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.pyView file

297patternName = generic_password severity = medium line = 297

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.pyView on unpkg · L297

351patternName = generic_password severity = medium line = 351

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_async/git.pyView on unpkg · L351

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.pyView file

297patternName = generic_password severity = medium line = 297

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.pyView on unpkg · L297

351patternName = generic_password severity = medium line = 351

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/daytona/_sync/git.pyView on unpkg · L351

dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.pyView file

1820patternName = generic_password severity = medium line = 1820

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.pyView on unpkg · L1820

1847patternName = generic_password severity = medium line = 1847

Medium

Secret Pattern

Hardcoded password in dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.py

dist/payload/scripts/daytona/.venv/Lib/site-packages/pydantic/types.pyView on unpkg · L1847