open-walnut@0.6.12

Personal AI powered by Claude — task management, Claude Code sessions, memory system, and web UI

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The automatic install hook suppresses a safety reminder in the package's Claude Agent SDK dependency, and the package later uses that SDK for agent sessions. The source supports a warning for agent lifecycle risk, but does not establish a broader concrete attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm runs its postinstall hook.

Impact

Later sessions using the SDK may run without that malware-analysis reminder.

Mechanism

The hook applies a version-matched patch to the installed SDK CLI, replacing the reminder text with the patch's altered content.

AI rationale

Evidence

package.jsonscripts/postinstall.mjspatches/@anthropic-ai+claude-agent-sdk+0.2.50.patchdist/cli.jsnode_modules/@anthropic-ai/claude-agent-sdk/cli.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The npm postinstall hook automatically runs the package installer.
The installer patches the installed Claude Agent SDK CLI when its version matches the shipped patch.
The patch removes the SDK reminder that tells the agent to consider malware when reading files and limits assistance that would improve malware.
The CLI imports the patched SDK when starting agent sessions.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 150 file(s), 6.64 MB of source, external domains: 127.0.0.1, docs.oasis-open.org, github.com, graph.microsoft.com, help.yahoo.com, json-schema.org, login.microsoftonline.com, myaccount.google.com, npms.io, openoffice.org, purl.oclc.org, purl.org, raw.githubusercontent.com, react.dev, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, sheetjs.openxmlformats.org, stuk.github.io, support.apple.com, support.microsoft.com, to-do.microsoft.com, tracker.example.com, walnut.invalid, www.apple.com, www.fastmail.help, www.w3.org

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

8// plugin-store/walnut-rhythm/src/server/exec.ts L9: import { execFile } from "node:child_process"; L10: var MAX_BUFFER = 1024 * 1024;

High

Child Process

Package source references child process execution.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/plugin-store/walnut-rhythm/dist/server.mjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg

dist/workers/git-compaction-worker.jsView file

1256var NETWORK_GIT_RE = /^(?:clone|fetch|pull|push|ls-remote)\b/; L1257: var execAsync = promisify2(exec); L1258: function credentialGuardArgs(cwd) {

High

Shell

Package source references shell execution.

dist/workers/git-compaction-worker.jsView on unpkg · L1256

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/workers/git-compaction-worker.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workers/git-compaction-worker.jsView on unpkg

dist/web/static/assets/jszip.min-CSpmuVKF.jsView file

11*/var zt;function Ot(){return zt||(zt=1,(function(yt,Rt){(function(b){yt.exports=b()})(function(){return(function b(U,k,l){function o(_,y){if(!k[_]){if(!U[_]){var p=typeof vt=="fun... L12: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(V.crc32,4),G+=l(V.compressedSize,4),G+=l(V.uncompressedSize,4),G+=l(L.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/static/assets/jszip.min-CSpmuVKF.jsView on unpkg · L11

bin/open-walnut.jsView file

63} L64: import(entryPath.href).catch((err) => { L65: process.stderr.write(`walnut: cannot load ${entry}: ${err && err.message ? err.message : err}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/open-walnut.jsView on unpkg · L63

dist/daemon-binaries/daemon-service-cli.cjsView file

Lines 1-21javascript

1var ei=Object.create;var{getPrototypeOf:ti,defineProperty:Be,getOwnPropertyNames:cr,getOwnPropertyDescriptor:ri}=Object,Dt=Object.prototype.hasOwnProperty;function lr(e){

dist/daemon-binaries/dtach-linux-x64View file

•path = dist/daemon-binaries/dtach-linux-x64 kind = native_binary sizeBytes = 731144 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/daemon-binaries/dtach-linux-x64View on unpkg

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 12280287 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12529823 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/cli-fast.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-fast.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/cli-fast.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-fast.jsView on unpkg

dist/daemon-binaries/vscode-server-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/daemon-binaries/vscode-server-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/vscode-server-core.cjsView on unpkg

dist/daemon-binaries/acp-daemon-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/daemon-binaries/acp-daemon-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-daemon-core.cjsView on unpkg

dist/hooks/on-stop.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/hooks/on-compact.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-stop.jsView on unpkg

dist/daemon-binaries/external-scan-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/daemon-binaries/external-scan-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/external-scan-core.cjsView on unpkg

dist/hooks/on-compact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-compact.jsView on unpkg

dist/integrations/calendar/index.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = [redacted].js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/calendar/index.jsView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/actions/inbox-triage-batch.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/actions/inbox-triage-batch.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/actions/inbox-triage-batch.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

8// plugin-store/walnut-rhythm/src/server/exec.ts L9: import { execFile } from "node:child_process"; L10: var MAX_BUFFER = 1024 * 1024;

High

Child Process

Package source references child process execution.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg · L8

Findings

18 High9 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/plugin-store/walnut-rhythm/dist/server.mjs

HighShelldist/workers/git-compaction-worker.js

HighSame File Env Network Executiondist/daemon-binaries/daemon-service-cli.cjs

HighCommand Output Exfiltrationdist/daemon-binaries/daemon-service-cli.cjs

HighSemantic Analysis Limiteddist/cli-fast.js

HighKnown Malware Source Similaritydist/daemon-binaries/vscode-server-core.cjs

HighKnown Malware Source Similaritydist/daemon-binaries/acp-daemon-core.cjs

HighKnown Malware Source Similaritydist/daemon-binaries/daemon-service-cli.cjs

HighKnown Malware Source Similaritydist/hooks/on-stop.js

Affected versions and remediation

This report applies to open-walnut@0.6.12.

See all versions of open-walnut for other recorded verdicts.

Review the evidence and your use of open-walnut@0.6.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 05:29:14.522Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code