registry / nolo-cli / 0.97.4

nolo-cli@0.97.4

Agent-first terminal workspace for Nolo

AI Security Review

scanned 7h ago · by lpm-firewall-ai

A Chrome connector request can forward a locally stored connector token to an operator-selected endpoint.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A connector action runs while a token is available and an endpoint override is configured.

Impact

The connector token may be disclosed to the configured endpoint; the inspected default sends requests to localhost.

Mechanism

The client accepts an endpoint argument or environment override and attaches the token in an HTTP request header without restricting the destination.

AI rationale

The code permits a configured endpoint to receive the Nolo connector token without a destination restriction, so a warning is warranted. The default destination is localhost, and the inspected code does not establish covert theft or an active attack.

Evidence

chunk-YUNJN43V.js

Network endpoints1

127.0.0.1:${defaultPort}/rpc

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The connector token is read from a Nolo-specific file or environment variable.
The connector endpoint can be overridden through an argument or environment variable, with no destination restriction shown in the inspected code.
Connector requests send the token in a request header to the selected endpoint.
The agent guidance reader loads AGENTS.md from the working directory into the system context.

Evidence against

The default connector endpoint is localhost, and the token is for Nolo’s browser connector.
The inspected AGENTS.md reader is part of workspace guidance assembly; this alone does not establish an attack.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

Source & flagged code

13 flagged

chunk-7WCQEMPB.jsView file

15674import { dirname, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep } from "node:path"; L15675: import { spawn as spawnChildProcess3 } from "node:child_process"; L15676:

High

Child Process

Package source references child process execution.

chunk-7WCQEMPB.jsView on unpkg · L15674

199...titleParams ? { titleParams } : {}, L200: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L201: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L436: default: L437: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L438: } ... L470: while (i) { L471: h = h * 33 ^ str.charCodeAt(--i); L472: } ... L5480: }); L5481: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5482: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-7WCQEMPB.jsView on unpkg · L199

chunk-2SYTUTLI.js#virtual:normalized:round1View file

53const windowsRoot = env.SystemRoot?.trim() || env.WINDIR?.trim(); L54: const powershellPath = overrides.powershellPath ?? (windowsRoot ? join( L55: windowsRoot,

High

Shell

Package source references shell execution.

chunk-2SYTUTLI.js#virtual:normalized:round1View on unpkg · L53

chunk-VFWN2MLE.jsView file

8388} L8389: const importBridge = new Function("specifier", "return import(specifier)"); L8390: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-VFWN2MLE.jsView on unpkg · L8388

pdf-U6KSUEZZ.jsView file

9159_createCanvas(width, height) { L9160: const require2 = process.getBuiltinModule("module").createRequire(import.meta.url); L9161: const canvas = require2("@napi-rs/canvas");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pdf-U6KSUEZZ.jsView on unpkg · L9159

chunk-YUNJN43V.jsView file

Lines 10-50javascript

10import { resolve as resolve2 } from "node:path";

12// packages/desktop-chrome-connector/uploadSecurity.mjs

13import { existsSync, realpathSync, statSync } from "node:fs";

14import { isAbsolute, relative, resolve } from "node:path";

chunk-VN45QM57.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. chunk-VN45QM57.js: en: "Or run `/login --server <url>` to log in right here (opens a browser authorization URL).", en: "Waiting for browser authorization ({0} remaining)... (Ctrl+C to cancel)", writeFile: { en: "Write", zh: "\u5199\u5165" }, process.env.NOLO_CLAUDE_CODE_VERSION || process.env.CLAUDE_CODE_VERSION Authorization: `Bearer ${args.accessToken}`, throw new Error(`Cannot force-refresh non-OAuth API key ref "${rawRef}".`); throw new Error(`API key for "${rawRef}" not found locally.`); Authorization: "",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

chunk-VN45QM57.jsView on unpkg

chunk-2SYTUTLI.jsView file

Lines 3-43javascript

3} from "./chunk-A7GB5UGH.js";

4import {

5 DEFAULT_NOLO_SERVER_URL

6} from "./chunk-OLZBQWZU.js";

7import {

8 loadProfileConfig

9} from "./chunk-TNIX77YM.js";

machineCommands-GRIO3LQG.jsView file

Lines 1-26javascript

1import {

2 buildMachinePermissionPromptBlock,

3 handleConnectorRunMessage,

4 resolveMachineRunPermissionPolicy

5} from "./chunk-R5VLGKMK.js";

6import {

7 isConnectorWebSocketAuthError,

8 isConnectorWebSocketRetryableError,

High

Cross File Remote Execution Context

chromeCommands-K27J4OVZ.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chromeCommands-K27J4OVZ.js#virtual:normalized:round1View on unpkg

dist-NJC2W7I4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = dist-VODFSGNG.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-NJC2W7I4.jsView on unpkg

chunk-MP64VFGD.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-JDSUTNYY.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-MP64VFGD.jsView on unpkg

chunk-M5PVFLD4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-M5PVFLD4.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-M5PVFLD4.jsView on unpkg

Source & flagged code

13 flagged · loading source

chunk-7WCQEMPB.jsView file

15674import { dirname, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve4, sep } from "node:path"; L15675: import { spawn as spawnChildProcess3 } from "node:child_process"; L15676:

High

Child Process

Package source references child process execution.

chunk-7WCQEMPB.jsView on unpkg · L15674

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-7WCQEMPB.jsView on unpkg · L199

chunk-2SYTUTLI.js#virtual:normalized:round1View file

Findings

1 Critical9 High4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationchunk-YUNJN43V.js

HighChild Processchunk-7WCQEMPB.js

HighShellchunk-2SYTUTLI.js#virtual:normalized:round1

HighCredential Redirect Persistencechunk-VN45QM57.js

HighSandbox Evasion Gated Capabilitychunk-2SYTUTLI.js

HighCross File Remote Execution ContextmachineCommands-GRIO3LQG.js

HighSemantic Analysis LimitedchromeCommands-K27J4OVZ.js#virtual:normalized:round1

HighKnown Malware Source Similaritydist-NJC2W7I4.js

HighKnown Malware Source Similaritychunk-MP64VFGD.js

HighKnown Malware Source Similaritychunk-M5PVFLD4.js

MediumDynamic Requirepdf-U6KSUEZZ.js

Affected versions and remediation

This report applies to nolo-cli@0.97.4.

See version security history for other recorded verdicts.

Review the evidence and your use of nolo-cli@0.97.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-09 09:55:47.591Z (UTC).