Loading npm security reports…

octomux@1.1.0: AI-agent control-surface risk | LPM Firewall

registry / octomux / 1.1.0

octomux@1.1.0

[![npm version](https://img.shields.io/npm/v/octomux)](https://www.npmjs.com/package/octomux) [![license](https://img.shields.io/github/license/ShreyPaharia/octomux)](LICENSE) [![GitHub stars](https://img.shields.io/github/stars/ShreyPaharia/octomux)](htt

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation mutates the user-wide Claude Code skill directory without user invocation. It also may install the Claude Code CLI globally.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Persists package-provided instructions in Claude Code's global skills directory and changes the user's tool environment.

Mechanism

unconsented install-time AI-agent control-surface mutation

Policy narrative

On npm install, package.json runs scripts/postinstall.sh. That script creates $HOME/.claude/skills and copies every bundled SKILL.md there, affecting Claude Code globally without an explicit setup command. It also attempts a global npm installation of @anthropic-ai/claude-code. The CLI repeats global Claude skill/workflow writes when started.

Rationale

The package performs unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. This meets the install-control-surface block boundary regardless of the benign-looking skill contents inspected.

Evidence

package.jsonscripts/postinstall.shbin/octomux.jsskills/*/SKILL.md$HOME/.claude/skills/*global npm installation of @anthropic-ai/claude-code

Decision evidence

public snapshot

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/postinstall.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/postinstall.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-server/setup-status-54WC6S2N.jsView file

1import{b}from"./chunk-OIRUBP4J.js";import{d as S}from"./chunk-XQ7EQ3DU.js";import{b as p}from"./chunk-YZSABAAX.js";import{a as d,b as g,c as f}from"./chunk-UWUVS7F4.js";import"./ch...

High

Child Process

Package source references child process execution.

dist-server/setup-status-54WC6S2N.jsView on unpkg · L1

dist/assets/editor.worker-DyuDvpVp.jsView file

6`).slice(2).join(` L7: `))}}class ni extends Error{constructor(e,n){super(e),this.name="ListenerLeakError",this.stack=n}}class ri extends Error{constructor(e,n){super(e),this.name="ListenerRefusalError",... L8: `||t===" "}class Et{constructor(e,n,r){this.changes=e,this.moves=n,this.hitTimeout=r}}class Pa{constructor(e,n){this.lineRangeMapping=e,this.changes=n}}function Fa(t,e,n=(r,s)=>r==...

High

Shell

Package source references shell execution.

dist/assets/editor.worker-DyuDvpVp.jsView on unpkg · L6

bin/octomux.jsView file

2L3: import { execFileSync, exec as execCb } from 'child_process'; L4: import { readFileSync, existsSync, mkdirSync, readdirSync, cpSync, rmSync } from 'fs'; ... L9: L10: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L11: L12: // Read version from package.json at runtime L13: const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')); L14: const version = pkg.version; ... L36: function resolveTmuxBin() { L37: if (process.env.OCTOMUX_TMUX_BIN) return process.env.OCTOMUX_TMUX_BIN; L38: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/octomux.jsView on unpkg · L2

155// Dev path: locate tsx (local node_modules first, then walk up for git worktrees L156: // sharing a parent install, then fall back to `npx tsx` which respects PATH). L157: const entry = path.join(__dirname, '..', 'cli', 'review', 'index.ts'); ... L166: if (tsxBin) { L167: execFileSync(tsxBin, [entry, ...reviewArgs], { stdio: 'inherit' }); L168: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/octomux.jsView on unpkg · L155

26// Delegate to CLI (commander-based) for all other commands L27: await import('../cli/dist/index.js'); L28: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/octomux.jsView on unpkg · L26

dist-server/chunk-S67AOMGA.jsView file

1import{a as C,b as k,c as S,d as g,e as b,g as w,l as R}from"./chunk-NLRGIOB5.js";import{a as p}from"./chunk-UWUVS7F4.js";import{a as y}from"./chunk-FJPTEYLR.js";import{a as T}from... L2: `)){let s=o.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);if(!s)continue;let n=s[2].trim();(n.startsWith('"')&&n.endsWith('"')||n.startsWith("'")&&n.endsWith("'"))&&(n=n.slice(1,-1)),t[s[1]]... ... L13: ${o} L14: `}function ar(r){if(i.existsSync(r))for(let e of i.readdirSync(r,{withFileTypes:!0}))e.isFile()&&e.name.startsWith(M)&&(e.name.endsWith(".mdc")||e.name.endsWith(".md"))&&i.unlinkSy...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-server/chunk-S67AOMGA.jsView on unpkg · L1

dist-server/index.jsView file

1Manifest entrypoint (scripts.start) carries capability families absent from dist/build output: environment+network, execution+network L1: import{a as ti,b as ei,c as D,d as si,e as ri,f as oi}from"./chunk-JACWMK5E.js";import{c as wn}from"./chunk-B36SOK6W.js";import{a as yn,b as Rn,c as we,d as bn,e as vn,f as xn,g as... L2: `;E.write(X),k=sc(t,[],{cwd:r,env:{...process.env,...e},stdio:["pipe","pipe","pipe"]});let x=JSON.stringify(s);(h=k.stdin)==null||h.write(x,"utf8"),(w=k.stdin)==null||w.end(),(P=k.... L3: [octomux] duration_ms=${M} exit_code=timeout ... L10: `)+1,p=s.lastIndexOf(` L11: [octomux] duration_ms=`),h=(p>u?s.slice(u,p):s.slice(u)).slice(0,500);return{event:n,script:i,taskId:a,startedAt:c,durationMs:l,exitCode:f,excerpt:h}}catch{return null}}function yi... L12: `);return r.len

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

dist-server/index.jsView on unpkg · L1

10`)+1,p=s.lastIndexOf(` L11: [octomux] duration_ms=`),h=(p>u?s.slice(u,p):s.slice(u)).slice(0,500);return{event:n,script:i,taskId:a,startedAt:c,durationMs:l,exitCode:f,excerpt:h}}catch{return null}}function yi... L12: `);return r.length>vi?r.slice(r.length-vi):r}async function xi(t,s){try{if(!xc())return;let e=Sc(t,s);if(!e.trim())return;let r=`Summarize what this agent just did in one sentence,... ... L22: ${t}`,e=await xe({prompt:s,systemPrompt:Gc,timeoutMs:zc}),r=JSON.parse(e),o=typeof r.title=="string"&&r.title.trim()?r.title.trim().slice(0,50):xs(t).title,n=typeof r.description==... L23: `)[0]??"";r||(r=w.slice(0,80)||"Untitled task"),o||(o=n)}let i=process.env.OCTOMUX_AI_TASK_NAMING??"",a=i==="1"||i.toLowerCase()==="true";if(n&&a&&(!s||!e)){let w=await $i(t.initia... L24: `)[0])=

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist-server/index.jsView on unpkg · L10

scripts/rollup-to-feat.shView file

•path = scripts/rollup-to-feat.sh kind = build_helper sizeBytes = 3196 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/rollup-to-feat.shView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 40-80json

40 "build:diff-engine": "tsc -b packages/diff-engine",

41 "build:types": "tsc -b packages/types",

42 "build:test-fixtures": "tsc -b packages/test-fixtures",

43 "build:api-client": "tsc -b packages/api-client",

44 "build:server": "tsup --entry.index=server/index.ts --entry.startup=server/startup.ts --entry.cli-review=cli/review/index.ts --entry.orchestrator/mcp/server=server/orchestrator/mcp/server.ts --entry.agent-session/mcp/submit-result-server=server/agent-session/mcp/submit-result-server.ts --format esm --minify --out-dir dist-server --external better-sqlite3 --external node-pty --external ws --external @octomux/tmux-darwin-arm64 --external @octomux/tmux-darwin-x64 --external @octomux/tmux-linux-x64 --external @octomux/tmux-linux-arm64",

45 "start": "NODE_ENV=production node dist-server/index.js",

46 "test": "vitest run",

47 "test:watch": "vitest",

48 "test:e2e": "playwright test",

49 "test:e2e:ui": "playwright test --ui",

50 "test:mobile-terminal": "playwright test e2e/mobile-terminal-scroll.spec.ts",

51 "test:mobile-terminal:watch": "playwright test e2e/mobile-terminal-scroll.spec.ts --ui",

52 "screenshots:docs": "tsx scripts/seed-docs-demo.ts && OCTOMUX_SCREENSHOTS=1 OCTOMUX_DB_PATH=./data/docs-demo/tasks.db playwright test e2e/docs-screenshots.spec.ts",

53 "lint": "eslint .",

54 "lint:fix": "eslint . --fix",

55 "format": "prettier --write .",

56 "format:check": "prettier --check .",

57 "cli:build": "cd cli && tsc",

58 "typecheck": "tsc -b",

59 "prepublishOnly": "bun run build",

60 "postinstall": "bash scripts/postinstall.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L60

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L60

61 "prepare": "husky",

62 "changelog": "conventional-changelog -p conventionalcommits -i CHANGELOG.md -s",

63 "build:electron": "tsc -p electron/tsconfig.json",

64 "dist:electron": "bun run build && bun run build:electron && electron-builder"

65 },

66 "lint-staged": {

67 "*.{ts,tsx}": [

68 "eslint --fix",

69 "prettier --write"

70 ],

71 "*.{json,md,css,html}": [

72 "prettier --write"

73 ]

74 },

75 "trustedDependencies": [

76 "better-sqlite3",

77 "husky",

78 "node-pty"

79 ],

80 "dependencies": {

dist-server/setup-status-54WC6S2N.jsView file

Lines 1-2javascript

1import{b}from"./chunk-OIRUBP4J.js";import{d as S}from"./chunk-XQ7EQ3DU.js";import{b as p}from"./chunk-YZSABAAX.js";import{a as d,b as g,c as f}from

dist/assets/editor.worker-DyuDvpVp.jsView file

Lines 1-26javascript

1(function(){"use strict";var Us,$s,Hs,Ws;class zs{constructor(){this.listeners=[],this.unexpectedErrorHandler=function(e){setTimeout(()=>{

bin/octomux.jsView file

Lines 6-46javascript

6import { createRequire } from 'module';

7import path from 'path';

8import os from 'os';

9

10const __dirname = path.

dist-server/chunk-S67AOMGA.jsView file

Lines 1-15javascript

1import{a as C,b as k,c as S,d as g,e as b,g as w,l as R}from"./chunk-NLRGIOB5.js";import{a as p}from"./chunk-UWUVS7F4.js";import{a as

dist-server/index.jsView file

Lines 1-30javascript

1import{a as ti,b as ei,c as D,d as si,e as ri,f as oi}from"./chunk-JACWMK5E.js";import{c as wn}from"./chunk-B36SOK6W.js";import{a as yn,b as

scripts/rollup-to-feat.shView file

•path = scripts/rollup-to-feat.sh kind = build_helper sizeBytes = 3196 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/rollup-to-feat.shView on unpkg