Loading npm security reports…

orquesta-agent@0.2.246: Malicious npm security report (Block) | LPM Firewall

registry / orquesta-agent / 0.2.246

orquesta-agent@0.2.246

Local agent for Orquesta - connects your VM to the Orquesta dashboard

AI Security Review

scanned 25d ago · by lpm-firewall-ai

When the agent is connected, server-dispatched content can cause it to download and execute a shell script. In daemon mode it also periodically force-updates its global package installation, using passwordless sudo when available.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run the connected agent or daemon with a valid token; a server command containing the installer marker activates it.

Impact

Remote code can run with the agent's user privileges and may replace the globally installed agent.

Mechanism

Remote prompt-controlled curl-to-shell execution and automatic privileged self-update.

Attack narrative

After connection, heartbeat data can deliver pending commands to the execution handler. A specially marked command is parsed as an installer request and passed to a function that runs curl piped to sh for a remote sudosudo.dev URL. Separately, daemon mode periodically checks for and force-installs newer global releases, escalating to passwordless sudo when available. The hostname restriction does not constrain the downloaded script content.

AI rationale

The package contains a complete server-driven remote shell execution path and an automatic forced self-update path with optional sudo. Its harmless install banners do not mitigate these runtime behaviors.

Evidence

dist/sudosudo.jsdist/executor.jsdist/supabase.jsdist/daemon.js

Network endpoints2

getorquesta.com

Source & flagged code

24 flagged

package.jsonView file

Lines 1-38json

2 "name": "orquesta-agent",

3 "version": "0.2.246",

4 "description": "Local agent for Orquesta - connects your VM to the Orquesta dashboard",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "orquesta-agent": "./dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc && cp -r src/ui/public dist/ui/",

12 "build:bundle": "npm run build && npx esbuild dist/index.js --bundle --platform=node --target=node20 --format=esm --outfile=bin/orquesta-agent.mjs --external:@homebridge/node-pty-prebuilt-multiarch --banner:js=\"import{createRequire}from'module';const require=createRequire(import.meta.url);\" --minify",

13 "build:binary": "npm run build && bash scripts/build-binaries.sh",

14 "dev": "tsc --watch",

15 "start": "node dist/index.js",

16 "prepublishOnly": "npm run build:binary",

17 "preinstall": "node scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "postinstall": "node scripts/postinstall.js"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "keywords": [

21 "orquesta",

22 "agent",

23 "claude",

24 "ai",

25 "automation"

26 ],

27 "author": "Orquesta",

28 "license": "MIT",

29 "dependencies": {

30 "@anthropic-ai/sdk": "^0.95.1",

31 "@homebridge/node-pty-prebuilt-multiarch": "^0.13.1",

32 "@types/cors": "^2.8.19",

33 "@types/express": "^5.0.6",

34 "chalk": "^5.3.0",

35 "commander": "^11.1.0",

36 "cors": "^2.8.6",

37 "express": "^5.2.1",

38 "orquesta-cli": "0.2.141",

dist/ui/onboarding.jsView file

Lines 1-33javascript

1// First-run onboarding: the guided welcome experience that opens on the user's

2// machine the first time the agent connects after install. It explains what the

3// agent is, the execution modes (LLM engine / permissions / sandbox) and the

4// localhost:8080 manager UI — and lets the user apply those settings live.

5//

6// Design: the agent process itself serves the welcome page (embedded UI server)

7// so the "Configure now" step can apply changes to the RUNNING agent with no

8// restart. We open the browser only when a local display is present; on headless

9// servers (VMs, customer boxes over SSH) we just print a prominent URL banner.

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// Node.js version check — must run before any imports that use fetch/etc.

3const [major] = process.versions.node.split('.').map(Number);

4if (major < 20) {

5 console.error(

dist/supabase.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import { execSync } from 'child_process';

3import * as logger from './logger.js';

dist/sudosudo.jsView file

6* path) instead of letting the LLM interpret a privileged setup script. The L7: * installer URL is validated to be https://*.sudosudo.dev. This is how the L8: * Orquesta dashboard "activates" sudosudo on a box that already runs this agent — ... L10: */ L11: import { spawn } from 'child_process'; L12: const MARKER_RE = /<<ORQ_SUDOSUDO_INSTALL>>([\s\S]*?)<<\/ORQ_SUDOSUDO_INSTALL>>/; ... L17: try { L18: const spec = JSON.parse(m[1]); L19: if (typeof spec.install_url !== 'string' || !spec.install_url) ... L41: * Fetch + run the official sudosudo installer, streaming each output line to L42: * `onLine`. Resolves with the exit code. Rejects only if the URL is not a L43: * sudosudo.dev https URL or the process can't be spawned.

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = dist/sudosudo.js matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sudosudo.jsView on unpkg

dist/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. token: options.token, apiurl, }; fs.writefilesync(configpath, json.stringify(config, null, 2) + '\n'); console.log(' created .orquesta.json'); const gitignorepath = path.join(cwd, '.gitignore'); const entry = '.orquesta.json'; if (fs.existssync(gitignorepath)) { const content = fs.readfilesync(gitignorepath, 'utf8'); if (!content.includes(entry)) { fs.appendfilesync(gitignorepath, `\n# orquesta hook config (contains token)\n${entry}\n`); console.log(' added .orquesta.json to .gitignore'); } } else { fs.writefilesync(gitignorepath, `# orquesta hook co

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = dist/init.js matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

dist/hook.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hook.js#virtual:normalized:round1View on unpkg

dist/ui/server.jsView file

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = dist/ui/server.js matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/server.jsView on unpkg

scripts/build-binaries.shView file

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = scripts/build-binaries.sh matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-binaries.shView on unpkg

dist/daemon.jsView file

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = dist/daemon.js matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/coordination.jsView file

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = dist/coordination.js matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/coordination.jsView on unpkg

Source & flagged code

24 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/onboarding.jsView file

13// enough to resurface every launch. Opt out with ORQUESTA_SKIP_ONBOARDING=1. L14: import { spawn } from 'child_process'; L15: import * as path from 'path';

High

Child Process

Package source references child process execution.

dist/ui/onboarding.jsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = orquesta-agent@0.2.239 matchedPath = dist/ui/onboarding.js matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.239 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/onboarding.jsView on unpkg

dist/index.jsView file

171try { L172: sha = execSync('git rev-parse HEAD', { cwd: opts.execDir, stdio: 'pipe' }).toString().trim() || null; L173: } ... L175: } L176: const apiUrl = process.env.ORQUESTA_API_URL || 'https://getorquesta.com'; L177: const res = await fetch(`${apiUrl}/api/agent/assisted-report`, {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L171

15Trigger-reachable chain: scripts.start -> dist/index.js L15: const nodeBin = process.execPath.slice(0, process.execPath.lastIndexOf('/')); L16: const home = process.env.HOME || '/root'; L17: const extraPaths = [ ... L36: import { createSocketIOConnection, createExecutionChannel, setupSocketIOListeners, } from './socketio-transport.js'; L37: import { execSync, spawn } from 'child_process'; L38: import { execute, evaluate, cancel, cancelAll, hasRunningProcesses, checkClaudeAuth, configureAuth, gitClone, gitPull, gitCommitAndPush, gitNumstatSince, getCurrentGitBranch, setPe... ... L43: import { runFirstRunOnboarding } from './ui/onboarding.js'; L44: // Read version — try package.json first, fall back to env (for binary builds) L45: const __filename = fileURLToPath(import.meta.url); L46: const

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = orquesta-agent@0.2.245 matchedIdentity = npm:b3JxdWVzdGEtYWdlbnQ:0.2.245 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

dist/supabase.jsView file

1import * as os from 'os'; L2: import { execSync } from 'child_process'; L3: import * as logger from './logger.js'; ... L7: // Canonical domain. The legacy orquesta.live 308-redirects to getorquesta.com L8: // and Node's fetch (undici) STRIPS the Authorization header on cross-origin L9: // redirects — credentials/skills fetches were 401ing "Missing authorization" L10: // on every agent start until this default was updated. L11: const ORQUESTA_API = process.env.ORQUESTA_API_URL || 'https://getorquesta.com'; L12: let VERSION = '0.0.0'; ... L32: headers: { 'Content-Type': 'application/json' }, L33: body: JSON.stringify({ L34: token: agentToken,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/supabase.jsView on unpkg · L1

dist/sudosudo.jsView file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sudosudo.jsView on unpkg

dist/init.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

dist/hook.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hook.js#virtual:normalized:round1View on unpkg

dist/ui/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/server.jsView on unpkg

scripts/build-binaries.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-binaries.shView on unpkg

dist/daemon.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/coordination.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/coordination.jsView on unpkg

Source & flagged code

24 flagged

package.jsonView file

Lines 1-38json

2 "name": "orquesta-agent",

3 "version": "0.2.246",

4 "description": "Local agent for Orquesta - connects your VM to the Orquesta dashboard",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "orquesta-agent": "./dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc && cp -r src/ui/public dist/ui/",

13 "build:binary": "npm run build && bash scripts/build-binaries.sh",

14 "dev": "tsc --watch",

15 "start": "node dist/index.js",

16 "prepublishOnly": "npm run build:binary",

17 "preinstall": "node scripts/preinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "postinstall": "node scripts/postinstall.js"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 },

20 "keywords": [

21 "orquesta",

22 "agent",

23 "claude",

24 "ai",

25 "automation"

26 ],

27 "author": "Orquesta",

28 "license": "MIT",

29 "dependencies": {

30 "@anthropic-ai/sdk": "^0.95.1",

31 "@homebridge/node-pty-prebuilt-multiarch": "^0.13.1",

32 "@types/cors": "^2.8.19",

33 "@types/express": "^5.0.6",

34 "chalk": "^5.3.0",

35 "commander": "^11.1.0",

36 "cors": "^2.8.6",

37 "express": "^5.2.1",

38 "orquesta-cli": "0.2.141",

dist/ui/onboarding.jsView file

Lines 1-33javascript

1// First-run onboarding: the guided welcome experience that opens on the user's

2// machine the first time the agent connects after install. It explains what the

3// agent is, the execution modes (LLM engine / permissions / sandbox) and the

4// localhost:8080 manager UI — and lets the user apply those settings live.

5//

6// Design: the agent process itself serves the welcome page (embedded UI server)

7// so the "Configure now" step can apply changes to the RUNNING agent with no

8// restart. We open the browser only when a local display is present; on headless

9// servers (VMs, customer boxes over SSH) we just print a prominent URL banner.

dist/index.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// Node.js version check — must run before any imports that use fetch/etc.

3const [major] = process.versions.node.split('.').map(Number);

4if (major < 20) {

5 console.error(

dist/supabase.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import { execSync } from 'child_process';

3import * as logger from './logger.js';

dist/sudosudo.jsView file

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/sudosudo.jsView on unpkg · L6

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/sudosudo.jsView on unpkg

dist/init.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/init.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/init.jsView on unpkg

scripts/generate-manifest.shView file

•path = scripts/generate-manifest.sh kind = build_helper sizeBytes = 2081 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-manifest.shView on unpkg

dist/hook.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/hook.js#virtual:normalized:round1View on unpkg

dist/ui/server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/ui/server.jsView on unpkg

scripts/build-binaries.shView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/build-binaries.shView on unpkg

dist/daemon.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/daemon.jsView on unpkg

dist/coordination.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/coordination.jsView on unpkg

Lines 151-191javascript

151 * the terminal). Both finish identically: the server evaluates the gate and

152 * parks the item at `needs_review`. The split is the point — a gate computed on

153 * the machine being gated protects nobody, and this machine is the customer's.

154 *

155 * Best-effort throughout: a failure here must not fail work that already

156 * happened. The reviewer sees the item stuck in_progress and can nudge the run.

157 */

158async function postAssistedReport(opts) {

159 try {

160 const commit = await gitCommitAndPush(opts.execDir, opts.commitMessage);

161 // With an explicit base we always diff, even when this call committed

162 // nothing — a person working interactively may well have committed by

163 // hand, and reporting an empty diff for real work would send the reviewer

164 // an item that looks like a no-op.

165 const base = opts.diffBase && opts.diffBase !== opts.branch

166 ? opts.diffBase

167 : (commit.sha ? 'HEAD~1' : null);

168 const numstat = base ? gitNumstatSince(opts.execDir, base) : '';

169 let sha = commit.sha;

170 if (!sha && base) {

171 try {

172 sha = execSync('git rev-parse HEAD', { cwd: opts.execDir, stdio: 'pipe' }).toString().trim() || null;

173 }

174 catch { /* leave null — the server treats a missing sha as "no commit" */ }

175 }

176 const apiUrl = process.env.ORQUESTA_API_URL || 'https://getorquesta.com';

177 const res = await fetch(`${apiUrl}/api/agent/assisted-report`, {

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L171

178 method: 'POST',

179 headers: { 'Content-Type': 'application/json' },

180 body: JSON.stringify({

181 token: opts.token,

182 promptId: opts.promptId,

183 commitSha: sha,

184 branch: opts.branch,

185 numstat,

186 }),

187 });

188 if (!res.ok) {

189 logger.warn(`[assisted] report rejected (${res.status}) for item ${opts.itemId}`);

190 return;

191 }

orquesta-agent@0.2.246

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code