Loading npm security reports…

orquesta-agent: Malicious npm security report (Block) | LPM Firewall

registry / orquesta-agent / 0.2.239

orquesta-agent@0.2.239

Local agent for Orquesta - connects your VM to the Orquesta dashboard

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A remotely delivered command can fetch and execute a shell script from a permitted external domain. Daemon mode can also replace the global installation, including through passwordless sudo.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the connected agent in daemon mode and the service dispatches content containing the installer marker.

Impact

A service-side compromise or malicious dispatcher can execute an externally supplied installer and alter the host; changed project files may be sent to the service.

Mechanism

Remote shell execution, forced self-update, and project-artifact upload.

Attack narrative

The connected agent accepts special content from its dispatch path. When that content contains the sudosudo installer marker, it validates only the HTTPS sudosudo.dev hostname and executes curl piped to sh. Separately, daemon restart checks force-install a newer package version globally and may use passwordless sudo. This creates a remote-controlled execution and update channel beyond the normal user prompt flow.

Rationale

The package contains a concrete remote download-and-shell execution path plus silent privileged self-updating. Its install hooks are cosmetic, but runtime behavior is sufficient to block publication.

Evidence

dist/executor.jsdist/sudosudo.jsdist/daemon.jspackage.jsonscripts/preinstall.jsscripts/postinstall.jsdist/init.js

Network endpoints2

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/onboarding.jsView file

13// enough to resurface every launch. Opt out with ORQUESTA_SKIP_ONBOARDING=1. L14: import { spawn } from 'child_process'; L15: import * as path from 'path';

High

Child Process

Package source references child process execution.

dist/ui/onboarding.jsView on unpkg · L13

dist/index.jsView file

709freshCredentials['ORQUESTA_TOKEN'] = token; L710: freshCredentials['ORQUESTA_API_URL'] = process.env.ORQUESTA_API_URL || 'https://getorquesta.com'; L711: { ... L723: try { L724: execSync(`git checkout ${subCfg.branch} 2>/dev/null || git checkout -b ${subCfg.branch}`, { cwd: execDir, stdio: 'pipe' }); L725: logger.info(`[sub-agent:${subCfg.name}] Checked out branch: ${subCfg.branch}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L709

15Trigger-reachable chain: scripts.start -> dist/index.js L15: const nodeBin = process.execPath.slice(0, process.execPath.lastIndexOf('/')); L16: const home = process.env.HOME || '/root'; L17: const extraPaths = [ ... L36: import { createSocketIOConnection, createExecutionChannel, setupSocketIOListeners, } from './socketio-transport.js'; L37: import { execSync, spawn } from 'child_process'; L38: import { execute, evaluate, cancel, cancelAll, hasRunningProcesses, checkClaudeAuth, configureAuth, gitClone, gitPull, setPermissionMode, setSandboxConfig, setSandboxAccess, setAge... ... L43: import { runFirstRunOnboarding } from './ui/onboarding.js'; L44: // Read version — try package.json first, fall back to env (for binary builds) L45: const __filename = fileURLToPath(import.meta.url); L46: const

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = orquesta-agent@0.2.238 matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.238 similarity = 0.862 summary = stored previous version shares package body but lacks this dangerous source file

dist/supabase.jsView file

1import * as os from 'os'; L2: import { execSync } from 'child_process'; L3: import * as logger from './logger.js'; ... L7: // Canonical domain. The legacy orquesta.live 308-redirects to getorquesta.com L8: // and Node's fetch (undici) STRIPS the Authorization header on cross-origin L9: // redirects — credentials/skills fetches were 401ing "Missing authorization" L10: // on every agent start until this default was updated. L11: const ORQUESTA_API = process.env.ORQUESTA_API_URL || 'https://getorquesta.com'; L12: let VERSION = '0.0.0'; ... L32: headers: { 'Content-Type': 'application/json' }, L33: body: JSON.stringify({ L34: token: agentToken,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/supabase.jsView on unpkg · L1

dist/sudosudo.jsView file

6* path) instead of letting the LLM interpret a privileged setup script. The L7: * installer URL is validated to be https://*.sudosudo.dev. This is how the L8: * Orquesta dashboard "activates" sudosudo on a box that already runs this agent — ... L10: */ L11: import { spawn } from 'child_process'; L12: const MARKER_RE = /<<ORQ_SUDOSUDO_INSTALL>>([\s\S]*?)<<\/ORQ_SUDOSUDO_INSTALL>>/; ... L17: try { L18: const spec = JSON.parse(m[1]); L19: if (typeof spec.install_url !== 'string' || !spec.install_url) ... L41: * Fetch + run the official sudosudo installer, streaming each output line to L42: * `onLine`. Resolves with the exit code. Rejects only if the URL is not a L43: * sudosudo.dev https URL or the process can't be spawned.

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

dist/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. token: options.token, apiurl, }; fs.writefilesync(configpath, json.stringify(config, null, 2) + '\n'); console.log(' created .orquesta.json'); const gitignorepath = path.join(cwd, '.gitignore'); const entry = '.orquesta.json'; if (fs.existssync(gitignorepath)) { const content = fs.readfilesync(gitignorepath, 'utf8'); if (!content.includes(entry)) { fs.appendfilesync(gitignorepath, `\n# orquesta hook config (contains token)\n${entry}\n`); console.log(' added .orquesta.json to .gitignore'); } } else { fs.writefilesync(gitignorepath, `# orquesta hook co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 1-38json

1{

2 "name": "orquesta-agent",

3 "version": "0.2.239",

4 "description": "Local agent for Orquesta - connects your VM to the Orquesta dashboard",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "orquesta-agent": "./dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc && cp -r src/ui/public dist/ui/",

12 "build:bundle": "npm run build && npx esbuild dist/index.js --bundle --platform=node --target=node20 --format=esm --outfile=bin/orquesta-agent.mjs --external:@homebridge/node-pty-prebuilt-multiarch --banner:js=\"import{createRequire}from'module';const require=createRequire(import.meta.url);\" --minify",

13 "build:binary": "npm run build && bash scripts/build-binaries.sh",

14 "dev": "tsc --watch",

15 "start": "node dist/index.js",

16 "prepublishOnly": "npm run build:binary",

17 "preinstall": "node scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "postinstall": "node scripts/postinstall.js"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "keywords": [

21 "orquesta",

22 "agent",

23 "claude",

24 "ai",

25 "automation"

26 ],

27 "author": "Orquesta",

28 "license": "MIT",

29 "dependencies": {

30 "@anthropic-ai/sdk": "^0.95.1",

31 "@homebridge/node-pty-prebuilt-multiarch": "^0.13.1",

32 "@types/cors": "^2.8.19",

33 "@types/express": "^5.0.6",

34 "chalk": "^5.3.0",

35 "commander": "^11.1.0",

36 "cors": "^2.8.6",

37 "express": "^5.2.1",

38 "orquesta-cli": "0.2.130",

dist/ui/onboarding.jsView file

Lines 1-33javascript

1// First-run onboarding: the guided welcome experience that opens on the user's

2// machine the first time the agent connects after install. It explains what the

3// agent is, the execution modes (LLM engine / permissions / sandbox) and the

4// localhost:8080 manager UI — and lets the user apply those settings live.

5//

6// Design: the agent process itself serves the welcome page (embedded UI server)

7// so the "Configure now" step can apply changes to the RUNNING agent with no

8// restart. We open the browser only when a local display is present; on headless

9// servers (VMs, customer boxes over SSH) we just print a prominent URL banner.

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// Node.js version check — must run before any imports that use fetch/etc.

3const [major] = process.versions.node.split('.').map(Number);

4if (major < 20) {

5 console.error(

dist/supabase.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import { execSync } from 'child_process';

3import * as logger from './logger.js';

dist/sudosudo.jsView file

6* path) instead of letting the LLM interpret a privileged setup script. The L7: * installer URL is validated to be https://*.sudosudo.dev. This is how the L8: * Orquesta dashboard "activates" sudosudo on a box that already runs this agent — ... L10: */ L11: import { spawn } from 'child_process'; L12: const MARKER_RE = /<<ORQ_SUDOSUDO_INSTALL>>([\s\S]*?)<<\/ORQ_SUDOSUDO_INSTALL>>/; ... L17: try { L18: const spec = JSON.parse(m[1]); L19: if (typeof spec.install_url !== 'string' || !spec.install_url) ... L41: * Fetch + run the official sudosudo installer, streaming each output line to L42: * `onLine`. Resolves with the exit code. Rejects only if the URL is not a L43: * sudosudo.dev https URL or the process can't be spawned.

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

dist/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. token: options.token, apiurl, }; fs.writefilesync(configpath, json.stringify(config, null, 2) + '\n'); console.log(' created .orquesta.json'); const gitignorepath = path.join(cwd, '.gitignore'); const entry = '.orquesta.json'; if (fs.existssync(gitignorepath)) { const content = fs.readfilesync(gitignorepath, 'utf8'); if (!content.includes(entry)) { fs.appendfilesync(gitignorepath, `\n# orquesta hook config (contains token)\n${entry}\n`); console.log(' added .orquesta.json to .gitignore'); } } else { fs.writefilesync(gitignorepath, `# orquesta hook co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

Lines 689-729javascript

689 // session). One promptId = at most one queued or running execution.

690 function isPromptQueuedOrRunning(promptId) {

691 return promptQueue.some(q => q.promptId === promptId) ||

692 [...runningExecutions.values()].some(e => e.promptId === promptId);

693 }

694 async function executePrompt(payload) {

695 const execId = payload.id;

696 runningExecutions.set(execId, { promptId: payload.promptId, commandId: execId, subAgentId: payload.subAgentId });

697 // Resolve working directory from sub-agent config

698 let execDir = payload.workingDirectory || workingDirectory;

699 const subCfg = payload.subAgentConfig;

700 if (subCfg?.workingDirectory) {

701 // Relative to agent root or absolute

702 execDir = path.isAbsolute(subCfg.workingDirectory) ? subCfg.workingDirectory : path.join(workingDirectory, subCfg.workingDirectory);

703 }

704 try {

705 // Refresh credentials

706 try {

707 const freshCredentials = await fetchCredentials();

708 if (token)

709 freshCredentials['ORQUESTA_TOKEN'] = token;

710 freshCredentials['ORQUESTA_API_URL'] = process.env.ORQUESTA_API_URL || 'https://getorquesta.com';

711 {

712 const pid = getCurrentProjectId();

713 if (pid)

714 freshCredentials['ORQUESTA_PROJECT_ID'] = pid;

715 }

716 setInjectedCredentials(freshCredentials);

717 }

718 catch {

719 // Non-fatal: continue with existing credentials

720 }

721 // Branch checkout if sub-agent has a configured branch

722 if (subCfg?.branch && fs.existsSync(path.join(execDir, '.git'))) {

723 try {

724 execSync(`git checkout ${subCfg.branch} 2>/dev/null || git checkout -b ${subCfg.branch}`, { cwd: execDir, stdio: 'pipe' });

725 logger.info(`[sub-agent:${subCfg.name}] Checked out branch: ${subCfg.branch}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L709

726 }

727 catch (err) {

728 logger.warn(`[sub-agent:${subCfg.name}] Branch checkout failed: ${err}`);

729 }