open-walnut@0.3.0: AI-agent control-surface risk

Loading npm security reports…

open-walnut@0.3.0: AI-agent control-surface risk | LPM Firewall

Source & flagged code

26 flagged

package.jsonView file

Lines 30-70json

30 "open-walnut": "./bin/open-walnut.js",

31 "walnut": "./bin/open-walnut.js"

32 },

33 "main": "./dist/cli.js",

34 "engines": {

35 "node": ">=22"

36 },

37 "files": [

38 "bin",

39 "dist",

40 "!dist/daemon-binaries/daemon-*",

41 "!dist/**/*.map",

42 "!dist/**/*.gz",

43 "patches",

44 "scripts/patch-qmd.mjs",

45 "scripts/postinstall.mjs",

46 "README.md",

47 "LICENSE"

48 ],

49 "scripts": {

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "prepublishOnly": "npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

52 "start": "npm run web:build && node dist/cli.js web --port 3456",

53 "build": "bash scripts/build-daemon.sh && tsup && rm -rf dist/data && cp -r src/data dist/ && for d in src/integrations/*/manifest.json; do cp \"$d\" \"dist/integrations/$(basename $(dirname $d))/\"; done",

54 "dev": "tsup --watch",

55 "test": "node scripts/test-parallel.mjs",

56 "test:quick": "vitest run --config vitest.quick.config.ts",

57 "test:slow": "vitest run --config vitest.slow.config.ts",

58 "test:focus": "vitest run --config vitest.focus.config.ts",

59 "test:frontend:ci": "node scripts/test-frontend.mjs",

60 "test:changed": "node scripts/test-changed.mjs",

61 "test:baseline": "node scripts/test-baseline.mjs check",

62 "test:baseline:record": "node scripts/test-baseline.mjs record",

63 "test:pre-commit": "node scripts/test-changed.mjs --tiers",

64 "test:unit": "vitest run --config vitest.unit.config.ts",

65 "test:integration": "vitest run --config vitest.integration.config.ts",

66 "test:e2e": "vitest run --config vitest.e2e.config.ts",

67 "test:live": "WALNUT_LIVE_TEST=1 vitest run --config vitest.live.config.ts",

68 "test:live:daemon": "bash scripts/run-live-daemon-tests.sh",

69 "test:live:cloud": "bash scripts/run-live-cloud-tests.sh",

70 "test:live:aws-setup": "bash scripts/run-live-aws-cloud-setup.sh",

dist/web/static/assets/index-B7OvpXOs.jsView file

158?| L159: |(?![\\s\\S])))+`,"m"),alias:i,inside:{line:{pattern:/(.)(?=[\s\S]).*(?:\r\n?|\n)?/,lookbehind:!0},prefix:{pattern:/[\s\S]/,alias:/\w+/.exec(s)[0]}}}}),Object.defineProperty(e.lang... L160: `);for(let g=0;g<m.length;g++)g>0&&(i+="</span>".repeat(o.length),r.push(i),i=o.map(y=>`<span class="${y}">`).join("")),i+=iSe(m[g])}else if(h.type==="element"){const m=(((d=h.prop...

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-B7OvpXOs.jsView on unpkg · L158

dist/workers/git-compaction-worker.jsView file

Lines 574-614javascript

574 }

575 /**

576 * Remove all subscribers.

577 */

578 clear() {

579 this.subscribers.clear();

580 }

581};

582var

dist/daemon-binaries/acp-worker.jsView file

Lines 1-21javascript

1var _D=Object.defineProperty;var Gr=(r,v)=>{for(var i in v)_D(r,i,{get:v[i],enumerable:!0,configurable:!0,

dist/web/static/assets/livescript-BwQOo05w.jsView file

Lines 1-2javascript

1var f=function(e,n){var g=n.next||"start";{n.next=n.next;var k=x[g];if(k.splice){for(var l

dist/workers/qmd-index-worker.jsView file

99function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir, ".git")).isDirectory()) return dir; ... L363: }, L364: // Credentials in URL userinfo: https://user:secret@host/...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/workers/qmd-index-worker.jsView on unpkg · L99

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

dist/workers/qmd-index-worker.jsView on unpkg · L99

dist/cli.jsView file

3294const os = require('os'); L3295: const http = require('http'); L3296: const net = require('net'); L3297: const { spawn, execSync } = require('child_process'); L3298: const crypto = require('crypto'); ... L3304: // (this template cannot import). Invoked from the argv dispatch in Main below L3305: // (async: the socket handlers call process.exit). Keep exit codes + command L3306: // surface in sync with wn-cli.ts and daemon-standalone.ts. L3307: function runWnMinimal(argv) { L3308: var out = function (s) { process.stdout.write(s + '\\n'); }; L3309: var errOut = function (s) { process.stderr.write(s + '\\n'); };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L3294

99function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir2, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir2, ".git")).isDirectory()) return dir2; ... L443: }, L444: // Credentials in URL userinfo: https://user:secret@host/...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L99

99Trigger-reachable chain: scripts.start -> dist/cli.js L99: function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir2, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir2, ".git")).isDirectory()) return dir2; ... L443: }, L444: // Credentials in URL userinfo: https://user:secret@host/...

dist/web/server.jsView file

99Cross-file remote execution chain: dist/web/server.js spawns dist/daemon-binaries/acp-worker.js; helper contains network access plus dynamic code execution. L99: function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir2, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir2, ".git")).isDirectory()) return dir2; .

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/web/server.jsView on unpkg · L99

99Detached bundled service listener: dist/web/server.js launches a Node helper and exposes a broad-bound HTTP listener. L99: function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir2, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir2, ".git")).isDirectory()) return dir2; ... L363: }, L364: // Credentials in URL

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/web/server.jsView on unpkg · L99

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.62 matchedPath = dist-renderer/assets/sql-D0XecflT.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.62 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.62 matchedPath = dist-renderer/assets/vbscript-BuJXcnF6.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.62 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/web/static/assets/index-B7OvpXOs.jsView file

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-B7OvpXOs.jsView on unpkg · L158

dist/workers/git-compaction-worker.jsView file

594var NETWORK_GIT_RE = /^(?:clone|fetch|pull|push|ls-remote)\b/; L595: var execAsync = promisify(exec); L596: function credentialGuardArgs(cwd) {

High

Shell

Package source references shell execution.

dist/workers/git-compaction-worker.jsView on unpkg · L594

dist/daemon-binaries/acp-worker.jsView file

1var _D=Object.defineProperty;var Gr=(r,v)=>{for(var i in v)_D(r,i,{get:v[i],enumerable:!0,configurable:!0,set:(u)=>v[i]=()=>u})};import lS from"node:crypto";import{spawn as GS}from... L2: `)}var pr=(r)=>(v,i,u,$)=>{let n=u?Object.assign(u,{async:!1}):{async:!1},g=v._zod.run({value:i,issues:[]},n);if(g instanceof Promise)throw new zr;if(g.issues.length){let I=new($?....

High

Eval

Package source references dynamic code evaluation.

dist/daemon-binaries/acp-worker.jsView on unpkg · L1

dist/web/static/assets/livescript-BwQOo05w.jsView file

1var f=function(e,n){var g=n.next||"start";{n.next=n.next;var k=x[g];if(k.splice){for(var l=0;l<k.length;++l){var t=k[l];if(t.regex&&e.match(t.regex))return n.next=t.next||n.next,t....

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/static/assets/livescript-BwQOo05w.jsView on unpkg · L1

dist/workers/qmd-index-worker.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/workers/qmd-index-worker.jsView on unpkg · L99

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

dist/workers/qmd-index-worker.jsView on unpkg · L99

dist/cli.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L3294

99function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir2, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir2, ".git")).isDirectory()) return dir2; ... L443: }, L444: // Credentials in URL userinfo: https://user:secret@host/...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L99

dist/web/server.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/web/server.jsView on unpkg · L99

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/web/server.jsView on unpkg · L99

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

Source & flagged code

26 flagged

package.jsonView file

Lines 30-70json

30 "open-walnut": "./bin/open-walnut.js",

31 "walnut": "./bin/open-walnut.js"

32 },

33 "main": "./dist/cli.js",

34 "engines": {

35 "node": ">=22"

36 },

37 "files": [

38 "bin",

39 "dist",

40 "!dist/daemon-binaries/daemon-*",

41 "!dist/**/*.map",

42 "!dist/**/*.gz",

43 "patches",

44 "scripts/patch-qmd.mjs",

45 "scripts/postinstall.mjs",

46 "README.md",

47 "LICENSE"

48 ],

49 "scripts": {

50 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L50

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L50

51 "prepublishOnly": "npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

52 "start": "npm run web:build && node dist/cli.js web --port 3456",

54 "dev": "tsup --watch",

55 "test": "node scripts/test-parallel.mjs",

56 "test:quick": "vitest run --config vitest.quick.config.ts",

57 "test:slow": "vitest run --config vitest.slow.config.ts",

58 "test:focus": "vitest run --config vitest.focus.config.ts",

59 "test:frontend:ci": "node scripts/test-frontend.mjs",

60 "test:changed": "node scripts/test-changed.mjs",

61 "test:baseline": "node scripts/test-baseline.mjs check",

62 "test:baseline:record": "node scripts/test-baseline.mjs record",

63 "test:pre-commit": "node scripts/test-changed.mjs --tiers",

64 "test:unit": "vitest run --config vitest.unit.config.ts",

65 "test:integration": "vitest run --config vitest.integration.config.ts",

66 "test:e2e": "vitest run --config vitest.e2e.config.ts",

67 "test:live": "WALNUT_LIVE_TEST=1 vitest run --config vitest.live.config.ts",

68 "test:live:daemon": "bash scripts/run-live-daemon-tests.sh",

69 "test:live:cloud": "bash scripts/run-live-cloud-tests.sh",

70 "test:live:aws-setup": "bash scripts/run-live-aws-cloud-setup.sh",

dist/web/static/assets/index-B7OvpXOs.jsView file

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-B7OvpXOs.jsView on unpkg · L158

dist/workers/git-compaction-worker.jsView file

Lines 574-614javascript

574 }

575 /**

576 * Remove all subscribers.

577 */

578 clear() {

579 this.subscribers.clear();

580 }

581};

582var

dist/daemon-binaries/acp-worker.jsView file

Lines 1-21javascript

1var _D=Object.defineProperty;var Gr=(r,v)=>{for(var i in v)_D(r,i,{get:v[i],enumerable:!0,configurable:!0,

dist/web/static/assets/livescript-BwQOo05w.jsView file

Lines 1-2javascript

1var f=function(e,n){var g=n.next||"start";{n.next=n.next;var k=x[g];if(k.splice){for(var l

dist/workers/qmd-index-worker.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/workers/qmd-index-worker.jsView on unpkg · L99

High

Hidden Inline Dependency Execution

Source silently spawns a Node process to execute an inline dependency payload.

dist/workers/qmd-index-worker.jsView on unpkg · L99

dist/cli.jsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/cli.jsView on unpkg · L3294

99function resolveOpenWalnutHome() { L100: const envHome = process.env.OPEN_WALNUT_HOME; L101: const productionHome = path.join(os.homedir(), ".open-walnut"); L102: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L114: if (isEphemeralTmpDir(envHome)) { L115: process.stderr.write( L116: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L306: try { L307: const pkg = JSON.parse(fs.readFileSync(path.join(dir2, "package.json"), "utf8")); L308: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir2, ".git")).isDirectory()) return dir2; ... L443: }, L444: // Credentials in URL userinfo: https://user:secret@host/...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/cli.jsView on unpkg · L99

dist/web/server.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/web/server.jsView on unpkg · L99

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/web/server.jsView on unpkg · L99

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

open-walnut@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code