open-walnut@0.6.9

Personal AI powered by Claude — task management, Claude Code sessions, memory system, and web UI

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The automatic hook’s attempted removal of an SDK safety reminder is a concrete agent-control risk. The source does not confirm that the patch is successfully applied, so this is suspicious rather than a verified control hijack.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package through npm, which runs its postinstall hook.

Impact

If the replacement succeeds, the SDK’s malware-analysis safety reminder is removed. Successful application is not established by the inspected source.

Mechanism

The hook resolves the installed SDK, checks its version, reads its CLI file, and attempts a text replacement using the matching patch.

AI rationale

Evidence

package.jsonscripts/postinstall.mjspatches/@anthropic-ai+claude-agent-sdk+0.2.50.patch

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The manifest runs scripts/postinstall.mjs automatically after installation.
The postinstall script locates the installed Claude Agent SDK and attempts to replace text in its CLI file.
The shipped patch removes a Claude SDK system reminder about safe malware analysis; whether the install-time patch applies as intended remains unclear.

Evidence against

The patch is narrowly tied to a specific SDK patch file and checks that the installed SDK version matches its target.
The inspected source does not establish that the attempted reminder change succeeds.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

Source & flagged code

18 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

8// plugin-store/walnut-rhythm/src/server/exec.ts L9: import { execFile } from "node:child_process"; L10: var MAX_BUFFER = 1024 * 1024;

High

Child Process

Package source references child process execution.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg · L8

dist/workers/git-compaction-worker.jsView file

1256var NETWORK_GIT_RE = /^(?:clone|fetch|pull|push|ls-remote)\b/; L1257: var execAsync = promisify2(exec); L1258: function credentialGuardArgs(cwd) {

High

Shell

Package source references shell execution.

dist/workers/git-compaction-worker.jsView on unpkg · L1256

dist/web/static/assets/jszip.min-BKC4W5iO.jsView file

11*/var zt;function Ot(){return zt||(zt=1,(function(yt,Rt){(function(b){yt.exports=b()})(function(){return(function b(U,k,l){function o(_,y){if(!k[_]){if(!U[_]){var p=typeof vt=="fun... L12: \0`,G+=l(E,2),G+=D.magic,G+=l(v,2),G+=l(S,2),G+=l(V.crc32,4),G+=l(V.compressedSize,4),G+=l(V.uncompressedSize,4),G+=l(L.length,2),G+=l(T.length,2),{fileRecord:p.LOCAL_FILE_HEADER+G...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/web/static/assets/jszip.min-BKC4W5iO.jsView on unpkg · L11

bin/open-walnut.jsView file

63} L64: import(entryPath.href).catch((err) => { L65: process.stderr.write(`walnut: cannot load ${entry}: ${err && err.message ? err.message : err}\n`);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/open-walnut.jsView on unpkg · L63

dist/daemon-binaries/daemon-service-cli.cjsView file

Lines 1-21javascript

1var $n=Object.create;var{getPrototypeOf:An,defineProperty:Re,getOwnPropertyNames:er,getOwnPropertyDescriptor:Fn}=Object,vt=Object.prototype.hasOwnProperty;function tr(e){

dist/daemon-binaries/dtach-linux-x64View file

•path = dist/daemon-binaries/dtach-linux-x64 kind = native_binary sizeBytes = 731144 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/daemon-binaries/dtach-linux-x64View on unpkg

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView file

•path = dist/data/skills/walnut-register-repo/scripts/validate-repo.py kind = build_helper sizeBytes = 5994 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/data/skills/walnut-register-repo/scripts/validate-repo.pyView on unpkg

dist/web/server.jsView file

•path = dist/web/server.js kind = oversized_source_file sizeBytes = 11935115 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/web/server.jsView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 12182781 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/cli-fast.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli-fast.jsView on unpkg

dist/daemon-binaries/pi-acp.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.5.0 matchedPath = dist/daemon-binaries/pi-acp.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon-binaries/pi-acp.jsView on unpkg

dist/web/static/assets/sql-D0XecflT.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.5.0 matchedPath = dist/web/static/assets/sql-D0XecflT.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/sql-D0XecflT.jsView on unpkg

dist/web/static/assets/vbscript-BuJXcnF6.jsView file

•matchType = normalized_sha256 matchedPackage = open-walnut@0.5.0 matchedPath = dist/web/static/assets/vbscript-BuJXcnF6.js matchedIdentity = npm:b3Blbi13YWxudXQ:0.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/static/assets/vbscript-BuJXcnF6.jsView on unpkg

dist/daemon-binaries/external-scan-core.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = open-walnut@0.6.8 matchedIdentity = npm:b3Blbi13YWxudXQ:0.6.8 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/daemon-binaries/external-scan-core.cjsView on unpkg

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin-store/walnut-rhythm/dist/server.mjsView file

8// plugin-store/walnut-rhythm/src/server/exec.ts L9: import { execFile } from "node:child_process"; L10: var MAX_BUFFER = 1024 * 1024;

High

Child Process

Package source references child process execution.

dist/plugin-store/walnut-rhythm/dist/server.mjsView on unpkg · L8

Findings

1 Critical9 High9 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/daemon-binaries/external-scan-core.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/plugin-store/walnut-rhythm/dist/server.mjs

HighShelldist/workers/git-compaction-worker.js

HighSame File Env Network Executiondist/daemon-binaries/daemon-service-cli.cjs

HighCommand Output Exfiltrationdist/daemon-binaries/daemon-service-cli.cjs

HighSemantic Analysis Limiteddist/cli-fast.js

HighKnown Malware Source Similaritydist/daemon-binaries/pi-acp.js

HighKnown Malware Source Similaritydist/web/static/assets/sql-D0XecflT.js

HighKnown Malware Source Similaritydist/web/static/assets/vbscript-BuJXcnF6.js

Affected versions and remediation

This report applies to open-walnut@0.6.9.

See all versions of open-walnut for other recorded verdicts.

Review the evidence and your use of open-walnut@0.6.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 01:54:14.995Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code