Loading npm security reports…

pks-nexus-cli@1.0.33: Malicious npm security report (Block) | LPM Firewall

registry / pks-nexus-cli / 1.0.33

pks-nexus-cli@1.0.33

Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command execution & Web search. - Browser automation (using Playwright) & Desktop automation. - Git and Docker integration. - M

AI Security Review

scanned 22h ago · by lpm-firewall-ai

On CLI chat startup, the package silently inventories the host's installed and running applications plus username and hostname. On the next prompt it adds that data to hidden LLM context and sends it to the default remote provider.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the nexus chat CLI and submits a prompt.

Impact

Unconsented exfiltration of local user and software-usage metadata.

Mechanism

Silent host inventory injected into remote LLM request.

Attack narrative

The default chat path silently starts a background scan of installed and running applications and captures hostname and username. It then injects the result as hidden system context. The default configuration uses an anonymous remote DevToolbox provider, whose request code transmits system content to its API. This collection is neither necessary for a prompt nor surfaced to the user.

Rationale

This is concrete, unconsented host-metadata exfiltration to a package-selected remote endpoint during ordinary use. The lack of an install hook does not mitigate the runtime data-exfiltration behavior.

Evidence

package.jsondist/cli/repl.jsdist/core/system/system-context.service.jsdist/core/config/config.schema.jsdist/core/llm/llm.service.js/Applications/System/Applications~/Applications~/.nexus-node/config.json

Network endpoints

Source & flagged code

5 flagged

dist/core/tools/execute-command.tool.jsView file

Lines 1-47javascript

1import { z } from 'zod';

2import { BaseTool } from './tool.interface.js';

3import { exec } from 'child_process';

4import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

5const ExecuteCommandSchema = z.object({

6 command: z.string().optional().describe('The shell command line to run on the system.'),

7 cmd: z.union([z.string(), z.array(z.string())]).optional().describe('Alias for command (can be string or array of command parts).'),

8 workingDirectory: z.string().optional().describe('The working directory to run the command in.'),

9});

10export class ExecuteCommandTool extends BaseTool {

11 name = 'execute_command';

12 description = 'Executes a shell command on the host operating system.';

13 inputSchema = ExecuteCommandSchema;

14 async execute(args) {

15 let rawCommand = args.command || '';

16 if (!rawCommand && args.cmd) {

17 if (Array.isArray(args.cmd)) {

18 rawCommand = args.cmd.join(' ');

19 }

20 else {

21 rawCommand = args.cmd;

22 }

23 }

24 let command = rawCommand.trim();

25 if (!command) {

26 return 'Error: Missing required parameter "command" or "cmd".';

27 }

28 // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd)

29 if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

30 let actualCmd = '';

31 if (command.startsWith('bash -lc '))

32 actualCmd = command.slice(9).trim();

33 else if (command.startsWith('sh -lc '))

34 actualCmd = command.slice(7).trim();

35 else

36 actualCmd = command.slice(8).trim(); // bash -c or sh -c (8 chars)

37 if ((actualCmd.startsWith('"') && actualCmd.endsWith('"')) ||

38 (actualCmd.startsWith("'") && actualCmd.endsWith("'"))) {

39 actualCmd = actualCmd.slice(1, -1);

40 }

41 command = actualCmd;

42 }

43 // 1. Basic Safety/Destructive Keyword Check

44 const destructiveKeywords = ['rm -rf /', 'rm -rf *', 'format ', 'del /f /s /q'];

45 const isDestructive = destructiveKeywords.some((kw) => command.includes(kw));

46 if (isDestructive) {

47 return `Error: Command execution rejected. Blocked destructive keyword match in: '${command}'`;

dist/core/plugins/plugin.manager.jsView file

Lines 20-60javascript

20 this.pluginsPath = path.join(homeDir, '.nexus-node', 'plugins');

21 }

22 }

23 /**

24 * Scans plugin directory and dynamically loads all plugins.

25 */

26 async

dist/core/tools/browser.tool.jsView file

Lines 7-47javascript

7 action: z.enum(['navigate', 'click', 'fill', 'screenshot', 'extract_text']).describe('The action to perform in the browser.'),

8 url: z.string().optional().describe

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.27 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.27 similarity = 0.961 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg