registry / Data exfiltration / pks-nexus-cli

pks-nexus-cli

<div align="center"> <img src="assets/nexus-terminal-demo.png" alt="Nexus CLI Terminal Demo" width="600" /> </div> Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command ex

This report shows the evidence for pks-nexus-cli@1.0.54. 4 of 9 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package has no install hook, but its normal runtime path silently harvests host application/process metadata and transmits it through its default remote LLM request path. This is a concrete unconsented data-exfiltration behavior, not merely an advertised user-invoked agent tool.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs nexus chat or the default CLI command.

Impact

Unconsented disclosure of host application and process context to the configured provider.

Mechanism

Silent host inventory injected into remote LLM prompt

Attack narrative

On CLI startup, ReplShell launches a background scan of standard application directories and visible processes without displaying this behavior. After up to three seconds it adds the resulting installed/running-app summary as hidden system context. A normal prompt is then sent to the configured LLM; the package defaults to the external devtoolbox workers.dev provider. This transmits machine inventory unrelated to the user's prompt and without consent.

AI rationale

Evidence

package.jsondist/cli/repl.jsdist/core/system/system-context.service.jsdist/core/config/config.schema.jsdist/core/llm/llm.service.js/Applications/Applications/Utilities/System/Applications/System/Applications/Utilities~/.nexus-node/config.json

Network endpoints1

devtoolbox-api.devtoolbox-api.workers.dev/ai/generate

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/cli/repl.js silently starts system context collection on CLI launch.
dist/core/system/system-context.service.js enumerates installed and running apps.
dist/cli/repl.js injects the collected system summary into LLM chat history.
dist/core/config/config.schema.js defaults to external devtoolbox-api.devtoolbox-api.workers.dev.
dist/core/llm/llm.service.js POSTs chat messages to the configured provider.

Evidence against

package.json has only prepublishOnly; no install-time hook.
dist/index.js only initializes the user-invoked CLI.
No hidden payload download or persistence mechanism was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 63 file(s), 305 KB of source, external domains: aistudio.google.com, api.groq.com, api.ipify.org, api.openai.com, arveon.in, build.nvidia.com, console.groq.com, deb.nodesource.com, devtoolbox-api.devtoolbox-api.workers.dev, devtoolboxes.uk, example.com, google.com, integrate.api.nvidia.com, openrouter.ai, raw.githubusercontent.com, text.pollinations.ai, timesofindia.indiatimes.com, wttr.in, www.bing.com, www.google.com

Source & flagged code

7 flagged

dist/core/tools/execute-command.tool.jsView file

2import { BaseTool } from './tool.interface.js'; L3: import { exec } from 'child_process'; L4: import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

27} L28: // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd) L29: if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

dist/core/plugins/plugin.manager.jsView file

Lines 20-60javascript

20 this.pluginsPath = path.join(homeDir, '.nexus-node', 'plugins');

21 }

22 }

23 /**

24 * Scans plugin directory and dynamically loads all plugins.

25 */

26 async loadPlugins(registry) {

27 try {

28 if (!fs.existsSync(this.pluginsPath)) {

29 fs.mkdirSync(this.pluginsPath, { recursive: true });

30 logger.debug(`Created plugins directory at: ${this.pluginsPath}`);

31 return;

32 }

33 const files = fs.readdirSync(this.pluginsPath);

34 const jsFiles = files.filter((f) => f.endsWith('.js'));

35 logger.info(`Scanning plugins directory. Found ${jsFiles.length} plugin candidates.`);

36 for (const file of jsFiles) {

37 const fullPath = path.join(this.pluginsPath, file);

38 const fileUrl = pathToFileURL(fullPath).href;

39 try {

40 // Dynamic Import over ESM file URL

41 const module = await import(fileUrl);

42 // Plugin should export default class or carry a Plugin property

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/plugins/plugin.manager.jsView on unpkg · L40

43 const PluginClass = module.default || module.Plugin;

44 if (!PluginClass) {

45 logger.warn(`Failed to load plugin '${file}': No default export or 'Plugin' class exported.`);

46 continue;

47 }

48 const instance = new PluginClass();

49 if (typeof instance.register !== 'function') {

50 logger.warn(`Failed to load plugin '${file}': Instance missing required 'register' method.`);

51 continue;

52 }

53 await instance.register(registry);

54 logger.info(`Successfully loaded and registered plugin: ${instance.name || file} (v${instance.version || '1.0.0'})`);

55 }

56 catch (err) {

57 logger.error(`Error loading dynamic plugin file '${file}': ${err.message}`);

58 }

59 }

60 }

dist/core/tools/browser.tool.jsView file

27const { execSync } = await import('child_process'); L28: execSync('npx playwright install chromium', { stdio: 'inherit' }); L29: browser = await chromium.launch({ headless: true });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/tools/browser.tool.jsView on unpkg · L27

skill/scripts/comment.pyView file

•path = skill/scripts/comment.py kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/comment.pyView on unpkg

dist/core/mcp/mcp.client.jsView file

•matchType = normalized_sha256 matchedPackage = pks-nexus-cli@1.0.46 matchedPath = dist/core/mcp/mcp.client.js matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/mcp/mcp.client.jsView on unpkg

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.34 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.34 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/core/tools/execute-command.tool.jsView file

2import { BaseTool } from './tool.interface.js'; L3: import { exec } from 'child_process'; L4: import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

dist/core/plugins/plugin.manager.jsView file

40// Dynamic Import over ESM file URL L41: const module = await import(fileUrl); L42: // Plugin should export default class or carry a Plugin property

Findings

1 Critical4 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli/repl.js

HighChild Processdist/core/tools/execute-command.tool.js

HighShelldist/core/tools/execute-command.tool.js

HighRuntime Package Installdist/core/tools/browser.tool.js

HighKnown Malware Source Similaritydist/core/mcp/mcp.client.js

MediumDynamic Requiredist/core/plugins/plugin.manager.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskill/scripts/comment.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Affected versions and remediation

This report applies to pks-nexus-cli@1.0.54.

The versions list below shows the verdict for each recorded version.

Avoid installing pks-nexus-cli@1.0.54. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-22 20:36:37.468Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

9 known versions

1.0.54latestshownMaliciousData ExfiltrationBlockPublishedJul 22, 2026, 8:34 PM 1.0.46MaliciousData ExfiltrationBlockPublishedJul 22, 2026, 6:53 PM 1.0.37MaliciousData ExfiltrationBlockPublishedJul 22, 2026, 6:10 PM 1.0.34SuspiciousRemote Code ExecutionWarnPublishedJul 19, 2026, 7:52 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code