Loading npm security reports…

open-walnut@0.4.4: AI-agent control-surface risk | LPM Firewall

registry / open-walnut / 0.4.4

open-walnut@0.4.4

Personal AI powered by Claude — task management, Claude Code sessions, memory system, and web UI

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the installed Claude Agent SDK. It removes a malware-safety reminder from that foreign AI-agent component.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

The consumer's Claude Agent SDK is altered without an explicit setup command, weakening its malware-safety instruction.

Mechanism

Automatic patching of a hoisted AI-agent SDK executable.

Policy narrative

On npm installation, postinstall finds the installed or hoisted Claude Agent SDK, reads the bundled patch, and overwrites that SDK's cli.js. The patch targets a system reminder requiring the agent to refuse improving malware, and the installer explicitly reports that the reminder is disabled. This is an unconsented install-time modification of a foreign AI-agent control surface.

Rationale

The package uses an automatic lifecycle hook to silently disable a safety instruction in a separately installed AI-agent SDK. The confirmed local CLI endpoint does not offset this concrete install-hook abuse.

Evidence

package.jsonscripts/postinstall.mjspatches/@anthropic-ai+claude-agent-sdk+0.2.50.patchnode_modules/@anthropic-ai/claude-agent-sdk/cli.js

Decision evidence

public snapshot

Source & flagged code

26 flagged

package.jsonView file

Lines 33-73json

33 "bin": {

34 "open-walnut": "./bin/open-walnut.js",

35 "walnut": "./bin/open-walnut.js"

36 },

37 "main": "./dist/cli.js",

38 "engines": {

39 "node": ">=22"

40 },

41 "files": [

42 "bin",

43 "dist",

44 "!dist/daemon-binaries/daemon-*",

45 "!dist/**/*.map",

46 "!dist/**/*.gz",

47 "patches",

48 "scripts/postinstall.mjs",

49 "README.md",

50 "LICENSE"

51 ],

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "prepublishOnly": "WALNUT_REQUIRE_BUN=1 npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

55 "prestart": "node scripts/check-node.mjs && node scripts/check-native-toolchain.mjs",

56 "start": "npm run web:build && node dist/cli.js web --port 3456",

57 "build:plugins": "npm run build -w @open-walnut/plugin-api && npm run build -w @open-walnut/plugin-cli",

58 "build": "npm run build:plugins && bash scripts/build-daemon.sh && tsup && rm -rf dist/data && cp -r src/data dist/ && for d in src/integrations/*/manifest.json; do cp \"$d\" \"dist/integrations/$(basename $(dirname $d))/\"; done && node scripts/ship-builtin-plugins.mjs",

59 "docs:check": "node scripts/generate-ops-docs.mjs --check --repo-only && node scripts/check-plugin-doc-snippets.mjs",

60 "test:plugin-packages": "npm run build:plugins && vitest run --config vitest.focus.config.ts tests/core/plugin-package-metadata.test.ts tests/core/plugin-cli-dev.test.ts tests/core/plugin-cli-scaffold.test.ts tests/core/plugin-publish-check.test.ts && node scripts/check-plugin-packages.mjs",

61 "dev": "tsup --watch",

62 "test": "node scripts/test-parallel.mjs",

63 "test:quick": "npm run docs:check && vitest run --config vitest.quick.config.ts",

64 "search:eval": "tsx scripts/search-eval.mjs",

65 "test:slow": "vitest run --config vitest.slow.config.ts",

66 "test:focus": "vitest run --config vitest.focus.config.ts",

67 "test:frontend:ci": "node scripts/test-frontend.mjs",

68 "test:changed": "node scripts/test-changed.mjs",

69 "test:baseline": "node scripts/test-baseline.mjs check",

70 "test:baseline:record": "node scripts/test-baseline.mjs record",

71 "test:pre-commit": "npm run docs:check && node scripts/test-changed.mjs --tiers",

72 "test:unit": "vitest run --config vitest.unit.config.ts",

73 "test:integration": "vitest run --config vitest.integration.config.ts",

dist/web/static/assets/index-B5OE08Hi.jsView file

352`))};if((Nn.mac||Nn.android)&&h.from==o-1&&/^\. ?$/.test(s.text)&&t.contentDOM.getAttribute("autocorrect")=="off"&&(h={from:a,to:c,insert:Or.of([s.text.replace("."," ")])}),this.pe... L353: --؜‎‏\u2028\u2029‭‮⁦⁧⁩\uFEFF￹-]`,H5),uWe={0:"null",7:"bell",8:"backspace",10:"newline",11:"vertical tab",13:"carriage return",27:"escape",8203:"zero width space",8204:"zero w... L354: `&&(n="");else{let s=n.indexOf(`

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-B5OE08Hi.jsView on unpkg · L352

dist/workers/git-compaction-worker.jsView file

Lines 1104-1144javascript

1104

1105// src/utils/json-conflict-recovery.ts

1106import fsp2 from "fs/promises";

1107import path3 from "path";

1108import os2 from "os";

1109import

dist/web/static/assets/pptx-preview.es-CW9hHNwC.jsView file

77`+x.message)}var a=new Lt;a.add(n),a.isGeoSVGGraphicRoot=!0;var i=t.width,o=t.height,s=t.viewBoxRect,l=this._boundingRect;if(!l){var u=void 0,c=void 0,h=void 0,v=void 0;if(i!=null?... L78: `+i.message)}return ij(t,a),R(a,function(i){var o=i.name;sj(t,i),uj(t,i);var s=this._specialAreas&&this._specialAreas[o];s&&i.transformTo(s.left,s.top,s.width,s.height)},this),a},r... L79: `))}),e.join(`

High

Eval

Package source references dynamic code evaluation.

dist/web/static/assets/pptx-preview.es-CW9hHNwC.jsView on unpkg · L77

bin/open-walnut.jsView file

Lines 43-68javascript

43 || (!sub && (args.includes('--version') || args.includes('-V'))));

44// The import is the whole program, so its failure must be LOUD. Unhandled, a

45// bundle that is momentarily empty (dist rewritten by a concurrent build) made

46// the CLI exit 0 having printed nothing at all — a caller in a loop reads that as

47// "the command answered, with nothing", which is the worst possible answer.

dist/integrations/calendar/index.jsView file

Lines 1-38javascript

1// src/core/calendar/index.ts

2import { createHash as createHash2 } from "crypto";

4// src/core/event-bus.ts

5import { randomBytes } from "crypto";

7// src/logging/logger.ts

dist/cli.jsView file

99842import os18 from "os"; L99843: import http2 from "http"; L99844: import crypto23 from "crypto"; L99845: import net from "net"; L99846: import { spawn as spawn9, execFile as execFile16 } from "child_process"; L99847: function homeDir() { L99848: return process.env.WALNUT_HOME_OVERRIDE || process.env.HOME || os18.homedir(); L99849: }

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L99842

26function apiBaseUrl() { L27: const raw = process.env.OPEN_WALNUT_API_URL?.trim(); L28: return (raw || DEFAULT_BASE_URL).replace(/\/+$/, ""); ... L34: try { L35: res = await fetch(base + path193, { L36: method, L37: ...body3 !== void 0 ? { headers: { "Content-Type": "application/json" }, body: JSON.stringify(body3) } : {}, L38: signal: AbortSignal.timeout(timeoutMs) ... L44: } L45: const text = res.status === 204 ? "" : await res.text(); L46: let parsed; ... L81: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L26

•Remote response is passed to a worker and executed with Node capabilities. dist/cli.js: function requireDirectRunners() { "WALNUT_CLI_DIRECT=1 requires the full CLI entry (dist/cli.js), which installs the direct runners. In tests, import ./direct-commands.js and call install() first." await requireDirectRunners().add(title, options, globals); await requireDirectRunners().tasks(options, globals); await requireDirectRunners().done(id, globals); await requireDirectRunners().recall(query, globals); await requireDirectRunners().projects(globals); await requireDirectRunners().sessions(globals); dist/cli.js: function requireDirectRunners() { "WALNUT_CLI_DIRECT=1 requires the full CLI entry (dist/cli.js), which installs the direct runners. In tests, import ./direct-commands.js and call install() f

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 7546292 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/daemon-binaries/acp-worker.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.3.2 matchedPath = dist/daemon-binaries/acp-worker.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-worker.jsView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.3.2 matchedPath = dist/web/static/assets/sql-D0XecflT.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.3.2 matchedPath = dist/web/static/assets/vbscript-BuJXcnF6.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.3.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/web/static/assets/index-B5OE08Hi.jsView file

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-B5OE08Hi.jsView on unpkg · L352

dist/workers/git-compaction-worker.jsView file

1124var NETWORK_GIT_RE = /^(?:clone|fetch|pull|push|ls-remote)\b/; L1125: var execAsync = promisify2(exec); L1126: function credentialGuardArgs(cwd) {

High

Shell

Package source references shell execution.

dist/workers/git-compaction-worker.jsView on unpkg · L1124

dist/web/static/assets/pptx-preview.es-CW9hHNwC.jsView file

High

Eval

Package source references dynamic code evaluation.

dist/web/static/assets/pptx-preview.es-CW9hHNwC.jsView on unpkg · L77

bin/open-walnut.jsView file

63} L64: import(entryPath.href).catch((err) => { L65: process.stderr.write(`walnut: cannot load ${entry}: ${err && err.message ? err.message : err}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/open-walnut.jsView on unpkg · L63

dist/integrations/calendar/index.jsView file

18var IS_EPHEMERAL = process.argv.includes("--_ephemeral-child"); L19: var CLOUD_MODE = process.env.WALNUT_CLOUD_MODE === "1"; L20: function resolveOpenWalnutHome() { L21: const envHome = process.env.OPEN_WALNUT_HOME; L22: const productionHome = path.join(os.homedir(), ".open-walnut"); L23: const isTestEnv = !!(process.env.VITEST || process.env.VITEST_WORKER_ID || process.env.NODE_ENV === "test"); ... L35: if (isEphemeralTmpDir(envHome)) { L36: process.stderr.write( L37: `WARNING: OPEN_WALNUT_HOME=${envHome} looks like a leaked ephemeral temp dir. ... L181: try { L182: const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8")); L183: if (pkg.name === "open-walnut" && fs.statSync(path.join(dir, ".git")).isDirectory()) return dir;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/integrations/calendar/index.jsView on unpkg · L18

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L99842

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L26

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 7546292 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/daemon-binaries/acp-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-worker.jsView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

Source & flagged code

26 flagged

package.jsonView file

Lines 33-73json

33 "bin": {

34 "open-walnut": "./bin/open-walnut.js",

35 "walnut": "./bin/open-walnut.js"

36 },

37 "main": "./dist/cli.js",

38 "engines": {

39 "node": ">=22"

40 },

41 "files": [

42 "bin",

43 "dist",

44 "!dist/daemon-binaries/daemon-*",

45 "!dist/**/*.map",

46 "!dist/**/*.gz",

47 "patches",

48 "scripts/postinstall.mjs",

49 "README.md",

50 "LICENSE"

51 ],

52 "scripts": {

53 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 "prepublishOnly": "WALNUT_REQUIRE_BUN=1 npm run build && cd web && npx vite build && cd .. && node scripts/check-publish.mjs",

55 "prestart": "node scripts/check-node.mjs && node scripts/check-native-toolchain.mjs",

56 "start": "npm run web:build && node dist/cli.js web --port 3456",

57 "build:plugins": "npm run build -w @open-walnut/plugin-api && npm run build -w @open-walnut/plugin-cli",

59 "docs:check": "node scripts/generate-ops-docs.mjs --check --repo-only && node scripts/check-plugin-doc-snippets.mjs",

61 "dev": "tsup --watch",

62 "test": "node scripts/test-parallel.mjs",

63 "test:quick": "npm run docs:check && vitest run --config vitest.quick.config.ts",

64 "search:eval": "tsx scripts/search-eval.mjs",

65 "test:slow": "vitest run --config vitest.slow.config.ts",

66 "test:focus": "vitest run --config vitest.focus.config.ts",

67 "test:frontend:ci": "node scripts/test-frontend.mjs",

68 "test:changed": "node scripts/test-changed.mjs",

69 "test:baseline": "node scripts/test-baseline.mjs check",

70 "test:baseline:record": "node scripts/test-baseline.mjs record",

71 "test:pre-commit": "npm run docs:check && node scripts/test-changed.mjs --tiers",

72 "test:unit": "vitest run --config vitest.unit.config.ts",

73 "test:integration": "vitest run --config vitest.integration.config.ts",

dist/web/static/assets/index-B5OE08Hi.jsView file

High

Child Process

Package source references child process execution.

dist/web/static/assets/index-B5OE08Hi.jsView on unpkg · L352

dist/workers/git-compaction-worker.jsView file

Lines 1104-1144javascript

1104

1105// src/utils/json-conflict-recovery.ts

1106import fsp2 from "fs/promises";

1107import path3 from "path";

1108import os2 from "os";

1109import

dist/web/static/assets/pptx-preview.es-CW9hHNwC.jsView file

High

Eval

Package source references dynamic code evaluation.

dist/web/static/assets/pptx-preview.es-CW9hHNwC.jsView on unpkg · L77

bin/open-walnut.jsView file

Lines 43-68javascript

43 || (!sub && (args.includes('--version') || args.includes('-V'))));

44// The import is the whole program, so its failure must be LOUD. Unhandled, a

45// bundle that is momentarily empty (dist rewritten by a concurrent build) made

46// the CLI exit 0 having printed nothing at all — a caller in a loop reads that as

47// "the command answered, with nothing", which is the worst possible answer.

dist/integrations/calendar/index.jsView file

Lines 1-38javascript

1// src/core/calendar/index.ts

2import { createHash as createHash2 } from "crypto";

4// src/core/event-bus.ts

5import { randomBytes } from "crypto";

7// src/logging/logger.ts

dist/cli.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/cli.jsView on unpkg · L99842

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli.jsView on unpkg · L26

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 7546292 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/daemon-binaries/acp-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-worker.jsView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code