orquesta-agent@0.2.238: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

orquesta-agent@0.2.238: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/onboarding.jsView file

13// enough to resurface every launch. Opt out with ORQUESTA_SKIP_ONBOARDING=1. L14: import { spawn } from 'child_process'; L15: import * as path from 'path';

High

Child Process

Package source references child process execution.

dist/ui/onboarding.jsView on unpkg · L13

dist/index.jsView file

708freshCredentials['ORQUESTA_TOKEN'] = token; L709: freshCredentials['ORQUESTA_API_URL'] = process.env.ORQUESTA_API_URL || 'https://getorquesta.com'; L710: { ... L722: try { L723: execSync(`git checkout ${subCfg.branch} 2>/dev/null || git checkout -b ${subCfg.branch}`, { cwd: execDir, stdio: 'pipe' }); L724: logger.info(`[sub-agent:${subCfg.name}] Checked out branch: ${subCfg.branch}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L708

15Trigger-reachable chain: scripts.start -> dist/index.js L15: const nodeBin = process.execPath.slice(0, process.execPath.lastIndexOf('/')); L16: const home = process.env.HOME || '/root'; L17: const extraPaths = [ ... L35: import { createSocketIOConnection, createExecutionChannel, setupSocketIOListeners, } from './socketio-transport.js'; L36: import { execSync, spawn } from 'child_process'; L37: import { execute, evaluate, cancel, cancelAll, hasRunningProcesses, checkClaudeAuth, configureAuth, gitClone, gitPull, setPermissionMode, setSandboxConfig, setSandboxAccess, setAge... ... L42: import { runFirstRunOnboarding } from './ui/onboarding.js'; L43: // Read version — try package.json first, fall back to env (for binary builds) L44: const __filename = fileURLToPath(import.meta.url); L45: const

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

15const nodeBin = process.execPath.slice(0, process.execPath.lastIndexOf('/')); L16: const home = process.env.HOME || '/root'; L17: const extraPaths = [ ... L35: import { createSocketIOConnection, createExecutionChannel, setupSocketIOListeners, } from './socketio-transport.js'; L36: import { execSync, spawn } from 'child_process'; L37: import { execute, evaluate, cancel, cancelAll, hasRunningProcesses, checkClaudeAuth, configureAuth, gitClone, gitPull, setPermissionMode, setSandboxConfig, setSandboxAccess, setAge... ... L42: import { runFirstRunOnboarding } from './ui/onboarding.js'; L43: // Read version — try package.json first, fall back to env (for binary builds) L44: const __filename = fileURLToPath(import.meta.url); L45: const __dirname = path.dirname(__filename); L46: let VERSION

dist/supabase.jsView file

1import * as os from 'os'; L2: import { execSync } from 'child_process'; L3: import * as logger from './logger.js'; ... L7: // Canonical domain. The legacy orquesta.live 308-redirects to getorquesta.com L8: // and Node's fetch (undici) STRIPS the Authorization header on cross-origin L9: // redirects — credentials/skills fetches were 401ing "Missing authorization" L10: // on every agent start until this default was updated. L11: const ORQUESTA_API = process.env.ORQUESTA_API_URL || 'https://getorquesta.com'; L12: let VERSION = '0.0.0'; ... L32: headers: { 'Content-Type': 'application/json' }, L33: body: JSON.stringify({ L34: token: agentToken,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/supabase.jsView on unpkg · L1

dist/sudosudo.jsView file

6* path) instead of letting the LLM interpret a privileged setup script. The L7: * installer URL is validated to be https://*.sudosudo.dev. This is how the L8: * Orquesta dashboard "activates" sudosudo on a box that already runs this agent — ... L10: */ L11: import { spawn } from 'child_process'; L12: const MARKER_RE = /<<ORQ_SUDOSUDO_INSTALL>>([\s\S]*?)<<\/ORQ_SUDOSUDO_INSTALL>>/; ... L17: try { L18: const spec = JSON.parse(m[1]); L19: if (typeof spec.install_url !== 'string' || !spec.install_url) ... L41: * Fetch + run the official sudosudo installer, streaming each output line to L42: * `onLine`. Resolves with the exit code. Rejects only if the URL is not a L43: * sudosudo.dev https URL or the process can't be spawned.

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

dist/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. token: options.token, apiurl, }; fs.writefilesync(configpath, json.stringify(config, null, 2) + '\n'); console.log(' created .orquesta.json'); const gitignorepath = path.join(cwd, '.gitignore'); const entry = '.orquesta.json'; if (fs.existssync(gitignorepath)) { const content = fs.readfilesync(gitignorepath, 'utf8'); if (!content.includes(entry)) { fs.appendfilesync(gitignorepath, `\n# orquesta hook config (contains token)\n${entry}\n`); console.log(' added .orquesta.json to .gitignore'); } } else { fs.writefilesync(gitignorepath, `# orquesta hook co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 1-38json

1{

2 "name": "orquesta-agent",

3 "version": "0.2.238",

4 "description": "Local agent for Orquesta - connects your VM to the Orquesta dashboard",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "orquesta-agent": "./dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc && cp -r src/ui/public dist/ui/",

12 "build:bundle": "npm run build && npx esbuild dist/index.js --bundle --platform=node --target=node20 --format=esm --outfile=bin/orquesta-agent.mjs --external:@homebridge/node-pty-prebuilt-multiarch --banner:js=\"import{createRequire}from'module';const require=createRequire(import.meta.url);\" --minify",

13 "build:binary": "npm run build && bash scripts/build-binaries.sh",

14 "dev": "tsc --watch",

15 "start": "node dist/index.js",

16 "prepublishOnly": "npm run build:binary",

17 "preinstall": "node scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "postinstall": "node scripts/postinstall.js"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "keywords": [

21 "orquesta",

22 "agent",

23 "claude",

24 "ai",

25 "automation"

26 ],

27 "author": "Orquesta",

28 "license": "MIT",

29 "dependencies": {

30 "@anthropic-ai/sdk": "^0.95.1",

31 "@homebridge/node-pty-prebuilt-multiarch": "^0.13.1",

32 "@types/cors": "^2.8.19",

33 "@types/express": "^5.0.6",

34 "chalk": "^5.3.0",

35 "commander": "^11.1.0",

36 "cors": "^2.8.6",

37 "express": "^5.2.1",

38 "orquesta-cli": "0.2.130",

dist/ui/onboarding.jsView file

Lines 1-33javascript

1// First-run onboarding: the guided welcome experience that opens on the user's

2// machine the first time the agent connects after install. It explains what the

3// agent is, the execution modes (LLM engine / permissions / sandbox) and the

4// localhost:8080 manager UI — and lets the user apply those settings live.

5//

6// Design: the agent process itself serves the welcome page (embedded UI server)

7// so the "Configure now" step can apply changes to the RUNNING agent with no

8// restart. We open the browser only when a local display is present; on headless

9// servers (VMs, customer boxes over SSH) we just print a prominent URL banner.

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// Node.js version check — must run before any imports that use fetch/etc.

3const [major] = process.versions.node.split('.').map(Number);

4if (major < 20) {

5 console.error(

dist/supabase.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import { execSync } from 'child_process';

3import * as logger from './logger.js';

dist/sudosudo.jsView file

6* path) instead of letting the LLM interpret a privileged setup script. The L7: * installer URL is validated to be https://*.sudosudo.dev. This is how the L8: * Orquesta dashboard "activates" sudosudo on a box that already runs this agent — ... L10: */ L11: import { spawn } from 'child_process'; L12: const MARKER_RE = /<<ORQ_SUDOSUDO_INSTALL>>([\s\S]*?)<<\/ORQ_SUDOSUDO_INSTALL>>/; ... L17: try { L18: const spec = JSON.parse(m[1]); L19: if (typeof spec.install_url !== 'string' || !spec.install_url) ... L41: * Fetch + run the official sudosudo installer, streaming each output line to L42: * `onLine`. Resolves with the exit code. Rejects only if the URL is not a L43: * sudosudo.dev https URL or the process can't be spawned.

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

dist/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. token: options.token, apiurl, }; fs.writefilesync(configpath, json.stringify(config, null, 2) + '\n'); console.log(' created .orquesta.json'); const gitignorepath = path.join(cwd, '.gitignore'); const entry = '.orquesta.json'; if (fs.existssync(gitignorepath)) { const content = fs.readfilesync(gitignorepath, 'utf8'); if (!content.includes(entry)) { fs.appendfilesync(gitignorepath, `\n# orquesta hook config (contains token)\n${entry}\n`); console.log(' added .orquesta.json to .gitignore'); } } else { fs.writefilesync(gitignorepath, `# orquesta hook co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

Lines 688-728javascript

688 // session). One promptId = at most one queued or running execution.

689 function isPromptQueuedOrRunning(promptId) {

690 return promptQueue.some(q => q.promptId === promptId) ||

691 [...runningExecutions.values()].some(e => e.promptId === promptId);

692 }

693 async function executePrompt(payload) {

694 const execId = payload.id;

695 runningExecutions.set(execId, { promptId: payload.promptId, commandId: execId, subAgentId: payload.subAgentId });

696 // Resolve working directory from sub-agent config

697 let execDir = payload.workingDirectory || workingDirectory;

698 const subCfg = payload.subAgentConfig;

699 if (subCfg?.workingDirectory) {

700 // Relative to agent root or absolute

701 execDir = path.isAbsolute(subCfg.workingDirectory) ? subCfg.workingDirectory : path.join(workingDirectory, subCfg.workingDirectory);

702 }

703 try {

704 // Refresh credentials

705 try {

706 const freshCredentials = await fetchCredentials();

707 if (token)

708 freshCredentials['ORQUESTA_TOKEN'] = token;

709 freshCredentials['ORQUESTA_API_URL'] = process.env.ORQUESTA_API_URL || 'https://getorquesta.com';

710 {

711 const pid = getCurrentProjectId();

712 if (pid)

713 freshCredentials['ORQUESTA_PROJECT_ID'] = pid;

714 }

715 setInjectedCredentials(freshCredentials);

716 }

717 catch {

718 // Non-fatal: continue with existing credentials

719 }

720 // Branch checkout if sub-agent has a configured branch

721 if (subCfg?.branch && fs.existsSync(path.join(execDir, '.git'))) {

722 try {

723 execSync(`git checkout ${subCfg.branch} 2>/dev/null || git checkout -b ${subCfg.branch}`, { cwd: execDir, stdio: 'pipe' });

724 logger.info(`[sub-agent:${subCfg.name}] Checked out branch: ${subCfg.branch}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L708

725 }

726 catch (err) {

727 logger.warn(`[sub-agent:${subCfg.name}] Branch checkout failed: ${err}`);

728 }