registry / nolo-cli / 0.97.3

nolo-cli@0.97.3

Agent-first terminal workspace for Nolo

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The browser connector can send its authentication token to a configured RPC endpoint. No confirmed attack was identified because this requires an explicitly configured endpoint and a connector request.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A caller uses a browser connector action while NOLO_CHROME_CONNECTOR_RPC_URL or an endpoint argument is set.

Impact

If configured to an untrusted endpoint, the token could be disclosed.

Mechanism

The connector reads a token from the environment or local token file, then attaches it to a POST request to the selected endpoint without destination validation.

AI rationale

The connector forwards a locally sourced token to an endpoint that can be overridden without a destination allowlist. This is a conditional credential exposure capability, not evidence of covert theft or active malicious behavior.

Evidence

chunk-YUNJN43V.js

Network endpoints1

127.0.0.1:38947/rpc

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The browser connector reads its token from an environment variable or a local token file in chunk-YUNJN43V.js.
The connector endpoint can be overridden through NOLO_CHROME_CONNECTOR_RPC_URL, and the request sends the token in a header without restricting the destination in chunk-YUNJN43V.js.
The cited readlineWorkspace-NHUN3ZFS.js location reads workspace AGENTS.md files for application context.

Evidence against

package.json has no lifecycle hooks; it exposes index.js as the CLI entry point.
The default connector endpoint is loopback, and sending the token requires a connector request.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

13 flagged

chunk-7WCQEMPB.jsView file

15674import { dirname, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep } from "node:path"; L15675: import { spawn as spawnChildProcess3 } from "node:child_process"; L15676:

High

Child Process

Package source references child process execution.

chunk-7WCQEMPB.jsView on unpkg · L15674

199...titleParams ? { titleParams } : {}, L200: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L201: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L436: default: L437: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L438: } ... L470: while (i) { L471: h = h * 33 ^ str.charCodeAt(--i); L472: } ... L5480: }); L5481: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5482: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-7WCQEMPB.jsView on unpkg · L199

chunk-GZQRBMMV.jsView file

Lines 11781-11821javascript

11781 }

11782 return buildAgentsMdLayer(content, name);

11783 } catch {

11784 }

11785 }

11786 return null;

11787}

11788

11789// packages/cli/agentRunDoD.ts

11790import { spawnSync as nodeSpawnSync } from "node:child_process";

11791var DOD_COMMAND_TIMEOUT_MS = 12e4;

11792function extractTailLines(text, count) {

11793 if (!text) return [];

11794 const lines = String(text).split("\n");

11795 while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();

11796 return lines.slice(-count);

11797}

11798function executeDoDCommand(cmd, cwd, deps = {}) {

11799 const spawnSync = deps.spawnSync ?? nodeSpawnSync;

11800 try {

11801 const res = spawnSync(cmd, {

11802 shell: true,

11803 cwd: cwd || process.cwd(),

High

Shell

Package source references shell execution.

chunk-GZQRBMMV.jsView on unpkg · L11801

11804 timeout: DOD_COMMAND_TIMEOUT_MS,

11805 maxBuffer: 10 * 1024 * 1024,

11806 encoding: "utf8"

11807 });

11808 if (res.error) {

11809 const errCode = res.error.code;

11810 const timedOut = errCode === "ETIMEDOUT" || res.signal === "SIGTERM" || res.signal === "SIGKILL";

11811 return {

11812 command: cmd,

11813 exitCode: timedOut ? "timeout" : "error",

11814 stdoutTail: extractTailLines(res.stdout, 20),

11815 stderrTail: extractTailLines(res.stderr || res.error.message, 10)

11816 };

11817 }

11818 if (res.status === null && (res.signal === "SIGTERM" || res.signal === "SIGKILL")) {

11819 return {

11820 command: cmd,

11821 exitCode: "timeout",

chunk-RMAWULCS.jsView file

8388} L8389: const importBridge = new Function("specifier", "return import(specifier)"); L8390: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-RMAWULCS.jsView on unpkg · L8388

pdf-U6KSUEZZ.jsView file

9159_createCanvas(width, height) { L9160: const require2 = process.getBuiltinModule("module").createRequire(import.meta.url); L9161: const canvas = require2("@napi-rs/canvas");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pdf-U6KSUEZZ.jsView on unpkg · L9159

chunk-YUNJN43V.jsView file

Lines 10-50javascript

10import { resolve as resolve2 } from "node:path";

12// packages/desktop-chrome-connector/uploadSecurity.mjs

13import { existsSync, realpathSync, statSync } from "node:fs";

14import { isAbsolute, relative, resolve } from "node:path";

chunk-JBOO3DKI.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. chunk-JBOO3DKI.js: en: "Or run `/login --server <url>` to log in right here (opens a browser authorization URL).", en: "Waiting for browser authorization ({0} remaining)... (Ctrl+C to cancel)", writeFile: { en: "Write", zh: "\u5199\u5165" }, process.env.NOLO_CLAUDE_CODE_VERSION || process.env.CLAUDE_CODE_VERSION Authorization: `Bearer ${args.accessToken}`, throw new Error(`Cannot force-refresh non-OAuth API key ref "${rawRef}".`); throw new Error(`API key for "${rawRef}" not found locally.`); Authorization: "",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

chunk-JBOO3DKI.jsView on unpkg

chunk-2SYTUTLI.jsView file

Lines 3-43javascript

3} from "./chunk-A7GB5UGH.js";

4import {

5 DEFAULT_NOLO_SERVER_URL

6} from "./chunk-OLZBQWZU.js";

7import {

8 loadProfileConfig

9} from "./chunk-TNIX77YM.js";

machineCommands-EY3SKJCP.jsView file

Lines 1-26javascript

1import {

2 buildMachinePermissionPromptBlock,

3 handleConnectorRunMessage,

4 resolveMachineRunPermissionPolicy

5} from "./chunk-X7YLNILS.js";

6import {

7 isConnectorWebSocketAuthError,

8 isConnectorWebSocketRetryableError,

High

Cross File Remote Execution Context

chromeCommands-K27J4OVZ.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chromeCommands-K27J4OVZ.js#virtual:normalized:round1View on unpkg

dist-NJC2W7I4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = dist-VODFSGNG.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-NJC2W7I4.jsView on unpkg

chunk-MP64VFGD.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-JDSUTNYY.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-MP64VFGD.jsView on unpkg

chunk-M5PVFLD4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-M5PVFLD4.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-M5PVFLD4.jsView on unpkg

Source & flagged code

13 flagged · loading source

chunk-7WCQEMPB.jsView file

15674import { dirname, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep } from "node:path"; L15675: import { spawn as spawnChildProcess3 } from "node:child_process"; L15676:

High

Child Process

Package source references child process execution.

chunk-7WCQEMPB.jsView on unpkg · L15674

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-7WCQEMPB.jsView on unpkg · L199

chunk-GZQRBMMV.jsView file

11801const res = spawnSync(cmd, { L11802: shell: true, L11803: cwd: cwd || process.cwd(),

Findings

1 Critical9 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationchunk-YUNJN43V.js

HighChild Processchunk-7WCQEMPB.js

HighShellchunk-GZQRBMMV.js

HighCredential Redirect Persistencechunk-JBOO3DKI.js

HighSandbox Evasion Gated Capabilitychunk-2SYTUTLI.js

HighCross File Remote Execution ContextmachineCommands-EY3SKJCP.js

HighSemantic Analysis LimitedchromeCommands-K27J4OVZ.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist-NJC2W7I4.js

HighKnown Malware Source Similaritychunk-MP64VFGD.js

HighKnown Malware Source Similaritychunk-M5PVFLD4.js

MediumDynamic Requirepdf-U6KSUEZZ.js

Affected versions and remediation

This report applies to nolo-cli@0.97.3.

See version security history for other recorded verdicts.

Review the evidence and your use of nolo-cli@0.97.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 09:41:57.012Z (UTC).