orquesta-agent@0.2.254
Local agent for Orquesta - connects your VM to the Orquesta dashboard
AI Security Review
scanned 25d ago · by lpm-firewall-aiThis is not sufficient evidence of package malware, but it exposes a concrete remotely triggered shell-injection path through the package's management channel. The unsafe agent-configuration sync is additional capability risk.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A connected agent receives an update message from its dashboard channel.
Impact
An actor able to send that dashboard event could inject shell syntax and execute commands with the agent's privileges.
Mechanism
The handler interpolates the received version into an npm command and executes it through a shell-capable command runner.
AI rationale
This is not sufficient evidence of package malware, but it exposes a concrete remotely triggered shell-injection path through the package's management channel. The unsafe agent-configuration sync is additional capability risk.
Evidence
dist/ws-client.jsdist/index.jsdist/supabase.js
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The active WebSocket client forwards dashboard update messages to an update callback.
- The update handler uses a dashboard-supplied version value without validation.
- That value is interpolated into a shell command and passed to synchronous command execution.
- The running agent also fetches and writes remote skills into the project Claude configuration.
Evidence against
- The install hooks shown are limited to a Node-version check and terminal messages.
- The observed remote-control behavior is consistent with the package's stated managed-agent role, but its input handling is unsafe.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
23 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.preinstall = node scripts/preinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/ui/onboarding.jsView file
Findings
5 Critical15 High8 Medium5 Low
CriticalSame File Env Network Executiondist/index.js
CriticalHardcoded Runtime Data Exfiltrationdist/supabase.js
CriticalDownload Executedist/sudosudo.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.js
CriticalPrevious Version Dangerous Deltadist/executor.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/ui/onboarding.js
HighShell
HighCredential Exfiltrationdist/index.js
HighTrigger Reachable External Ai Agent Control Surface Mutationdist/init.js
HighTrigger Reachable Credential Exfiltrationdist/index.js
High
Affected versions and remediation
This report applies to orquesta-agent@0.2.254.
See all versions of orquesta-agent for other recorded verdicts.
- Review the evidence and your use of orquesta-agent@0.2.254 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.