Loading npm security reports…

pks-nexus-cli@1.0.21: Suspicious npm security report (Warn) | LPM Firewall

registry / pks-nexus-cli / 1.0.21

pks-nexus-cli@1.0.21

Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command execution & Web search. - Browser automation (using Playwright) & Desktop automation. - Git and Docker integration. - M

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes the CLI and submits a prompt that leads to a tool call.

Impact

A malicious or prompt-injected model response can read sensitive local data, alter files, execute commands, and return captured data to the configured LLM.

Mechanism

Auto-approved LLM-directed host tools with unrestricted paths and shell execution.

Rationale

This is an advertised agentic CLI, not install-time malware, but its automatic approval bypass makes its broad host-control capability unsafe for an upstream firewall. No covert or unconsented install-time attack behavior was found.

Evidence

package.jsondist/cli/repl.jsdist/core/agent/agent.engine.jsdist/core/llm/llm.service.jsdist/core/tools/execute-command.tool.jsdist/core/tools/desktop.tools.js~/.nexus-node/config.jsonuser-selected absolute or relative file paths

Network endpoints2

devtoolbox-api.devtoolbox-api.workers.dev/ai/generate/search

Source & flagged code

5 flagged

dist/core/tools/execute-command.tool.jsView file

Lines 1-47javascript

1import { z } from 'zod';

2import { BaseTool } from './tool.interface.js';

3import { exec } from 'child_process';

4import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

5const ExecuteCommandSchema = z.object({

6 command: z.string().optional().describe('The shell command line to run on the system.'),

7 cmd: z.union([z.string(), z.array(z.string())]).optional().describe('Alias for command (can be string or array of command parts).'),

8 workingDirectory: z.string().optional().describe('The working directory to run the command in.'),

9});

10export class ExecuteCommandTool extends BaseTool {

11 name = 'execute_command';

12 description = 'Executes a shell command on the host operating system.';

13 inputSchema = ExecuteCommandSchema;

14 async execute(args) {

15 let rawCommand = args.command || '';

16 if (!rawCommand && args.cmd) {

17 if (Array.isArray(args.cmd)) {

18 rawCommand = args.cmd.join(' ');

19 }

20 else {

21 rawCommand = args.cmd;

22 }

23 }

24 let command = rawCommand.trim();

25 if (!command) {

26 return 'Error: Missing required parameter "command" or "cmd".';

27 }

28 // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd)

29 if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

30 let actualCmd = '';

31 if (command.startsWith('bash -lc '))

32 actualCmd = command.slice(9).trim();

33 else if (command.startsWith('sh -lc '))

34 actualCmd = command.slice(7).trim();

35 else

36 actualCmd = command.slice(8).trim(); // bash -c or sh -c (8 chars)

37 if ((actualCmd.startsWith('"') && actualCmd.endsWith('"')) ||

38 (actualCmd.startsWith("'") && actualCmd.endsWith("'"))) {

39 actualCmd = actualCmd.slice(1, -1);

40 }

41 command = actualCmd;

42 }

43 // 1. Basic Safety/Destructive Keyword Check

44 const destructiveKeywords = ['rm -rf /', 'rm -rf *', 'format ', 'del /f /s /q'];

45 const isDestructive = destructiveKeywords.some((kw) => command.includes(kw));

46 if (isDestructive) {

47 return `Error: Command execution rejected. Blocked destructive keyword match in: '${command}'`;

dist/core/plugins/plugin.manager.jsView file

Lines 20-60javascript

20 this.pluginsPath = path.join(homeDir, '.nexus-node', 'plugins');

21 }

22 }

23 /**

24 * Scans plugin directory and dynamically loads all plugins.

25 */

26 async

dist/core/tools/browser.tool.jsView file

Lines 7-47javascript

7 action: z.enum(['navigate', 'click', 'fill', 'screenshot', 'extract_text']).describe('The action to perform in the browser.'),

8 url: z.string().optional().describe

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.19 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.19 similarity = 0.960 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg