open-walnut@0.6.13

Personal AI powered by Claude — task management, Claude Code sessions, memory system, and web UI

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The install-time removal of an agent safety reminder presents a concrete but bounded agent lifecycle risk. The inspected source does not establish a publish-blocking attack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package runs its postinstall hook.

Impact

The modified SDK no longer supplies that reminder to the assistant, potentially weakening its handling of malware-related requests.

Mechanism

The hook applies a patch to the SDK CLI when its installed version matches the patch target.

AI rationale

The install-time removal of an agent safety reminder presents a concrete but bounded agent lifecycle risk. The inspected source does not establish a publish-blocking attack.

Evidence

scripts/postinstall.mjspatches/@anthropic-ai+claude-agent-sdk+0.2.50.patchpackage.json

Decision evidence

public snapshot

AI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs a postinstall script during installation.
The install script writes a version-matched patch into the installed Claude Agent SDK CLI.
The patch removes a reminder directing the assistant to refuse improving malware.
The package pins the SDK version that the patch targets.
The flagged configuration-path matches are ordinary path references; no attack was established from them.

Evidence against

The patch targets a specific SDK version and changes that SDK’s CLI file; inspected source did not establish credential theft, persistence, or remote execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

8// plugin-store/walnut-rhythm/src/server/exec.ts L9: import { execFile } from "node:child_process"; L10: var MAX_BUFFER = 1024 * 1024;

High

Child Process

Package source references child process execution.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/plugin-store/walnut-rhythm/dist/server.mjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg

dist/workers/git-compaction-worker.jsView file

1256var NETWORK_GIT_RE = /^(?:clone|fetch|pull|push|ls-remote)\b/; L1257: var execAsync = promisify2(exec); L1258: function credentialGuardArgs(cwd) {

High

Shell

Package source references shell execution.

dist/workers/git-compaction-worker.jsView on unpkg · L1256

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/workers/git-compaction-worker.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/workers/git-compaction-worker.jsView on unpkg

dist/web/static/assets/jszip.min-CSpmuVKF.jsView file

11*/var zt;function Ot(){return zt||(zt=1,(function(yt,Rt){(function(b){yt.exports=b()})(function(){return(function b(U,k,l){function o(_,y){if(!k[_]){if(!U[_]){var p=typeof vt=="fun... L12: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(V.crc32,4),G+=l(V.compressedSize,4),G+=l(V.uncompressedSize,4),G+=l(L.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/static/assets/jszip.min-CSpmuVKF.jsView on unpkg · L11

bin/open-walnut.jsView file

63} L64: import(entryPath.href).catch((err) => { L65: process.stderr.write(`walnut: cannot load ${entry}: ${err && err.message ? err.message : err}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/open-walnut.jsView on unpkg · L63

dist/daemon-binaries/daemon-service-cli.cjsView file

1var ei=Object.create;var{getPrototypeOf:ti,defineProperty:Be,getOwnPropertyNames:cr,getOwnPropertyDescriptor:ri}=Object,Dt=Object.prototype.hasOwnProperty;function lr(e){return thi... L2: `).join(`\r ... L6: \r L7: `+r)}function xe(e,t,r,n,i,s){if(e.listenerCount("wsClientError")){let o=Error(i);Error.captureStackTrace(o,xe),e.emit("wsClientError",o,r,t)}else Ye(r,n,i,s)}});var vo={};ci(vo,{d... L8: `)}function de(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'")}function _n(e,t){let r=e==="linux"?/^ExecSt...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/daemon-binaries/daemon-service-cli.cjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/daemon-binaries/daemon-service-cli.cjsView on unpkg · L1

dist/daemon-binaries/dtach-linux-x64View file

•path = dist/daemon-binaries/dtach-linux-x64 kind = native_binary sizeBytes = 731144 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/daemon-binaries/dtach-linux-x64View on unpkg

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 12280287 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12529823 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/cli-fast.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-fast.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/cli-fast.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli-fast.jsView on unpkg

dist/daemon-binaries/vscode-server-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/daemon-binaries/vscode-server-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/vscode-server-core.cjsView on unpkg

dist/daemon-binaries/acp-daemon-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/daemon-binaries/acp-daemon-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/acp-daemon-core.cjsView on unpkg

dist/hooks/on-stop.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/hooks/on-compact.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-stop.jsView on unpkg

dist/daemon-binaries/external-scan-core.cjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/daemon-binaries/external-scan-core.cjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/external-scan-core.cjsView on unpkg

dist/hooks/on-compact.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/hooks/on-compact.jsView on unpkg

dist/integrations/calendar/index.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = [redacted].js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/calendar/index.jsView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/actions/inbox-triage-batch.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.6.11 matchedPath = dist/actions/inbox-triage-batch.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/actions/inbox-triage-batch.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

8// plugin-store/walnut-rhythm/src/server/exec.ts L9: import { execFile } from "node:child_process"; L10: var MAX_BUFFER = 1024 * 1024;

High

Child Process

Package source references child process execution.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg · L8

Findings

18 High9 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/plugin-store/walnut-rhythm/dist/server.mjs

HighShelldist/workers/git-compaction-worker.js

HighSame File Env Network Executiondist/daemon-binaries/daemon-service-cli.cjs

HighCommand Output Exfiltrationdist/daemon-binaries/daemon-service-cli.cjs

HighSemantic Analysis Limiteddist/cli-fast.js

HighKnown Malware Source Similaritydist/daemon-binaries/vscode-server-core.cjs

HighKnown Malware Source Similaritydist/daemon-binaries/acp-daemon-core.cjs

HighKnown Malware Source Similaritydist/daemon-binaries/daemon-service-cli.cjs

HighKnown Malware Source Similaritydist/hooks/on-stop.js

Affected versions and remediation

This report applies to open-walnut@0.6.13.

See all versions of open-walnut for other recorded verdicts.

Review the evidence and your use of open-walnut@0.6.13 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 05:10:00.028Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code