Loading npm security reports…

pks-nexus-cli@1.0.37: Malicious npm security report (Block) | LPM Firewall

registry / pks-nexus-cli / 1.0.37

pks-nexus-cli@1.0.37

<div align="center"> <img src="assets/nexus-terminal-demo.png" alt="Nexus CLI Terminal Demo" width="600" /> </div> Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command ex

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Starting the CLI silently collects a broad local application and process inventory. With a configured non-direct LLM provider, the collected hostname, username, installed-app names, and running-app names are included in remote LLM messages.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User starts `nexus` and submits an agent request using a configured LLM provider.

Impact

Discloses local machine identity and software/process inventory to a remote service without an explicit collection prompt.

Mechanism

Covert host inventory collection and remote prompt exfiltration.

Attack narrative

On CLI startup, the package silently enumerates installed applications and foreground processes, records hostname and username, then places this data in hidden system context. Agent requests using configured standard LLM providers forward that system context to the provider endpoint. The collection is not needed to satisfy a normal prompt and is intentionally suppressed from terminal output.

Rationale

Source establishes a concrete covert collection-to-remote-message path, not merely a risky primitive. The absence of install hooks does not mitigate runtime data exfiltration after normal CLI launch.

Evidence

dist/cli/repl.jsdist/core/system/system-context.service.jsdist/core/agent/agent.engine.jsdist/core/llm/llm.service.jsdist/core/config/config.schema.js/Applications/Applications/Utilities

Source & flagged code

7 flagged · loading source

dist/core/tools/execute-command.tool.jsView file

2import { BaseTool } from './tool.interface.js'; L3: import { exec } from 'child_process'; L4: import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

27} L28: // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd) L29: if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

dist/core/plugins/plugin.manager.jsView file

40// Dynamic Import over ESM file URL L41: const module = await import(fileUrl); L42: // Plugin should export default class or carry a Plugin property

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/plugins/plugin.manager.jsView on unpkg · L40

dist/core/tools/browser.tool.jsView file

27const { execSync } = await import('child_process'); L28: execSync('npx playwright install chromium', { stdio: 'inherit' }); L29: browser = await chromium.launch({ headless: true });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/tools/browser.tool.jsView on unpkg · L27

skill/scripts/comment.pyView file

•path = skill/scripts/comment.py kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/comment.pyView on unpkg

dist/core/mcp/mcp.client.jsView file

•matchType = normalized_sha256 matchedPackage = pks-nexus-cli@1.0.33 matchedPath = dist/core/mcp/mcp.client.js matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.33 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/mcp/mcp.client.jsView on unpkg

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.34 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.34 similarity = 0.904 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg

Source & flagged code

7 flagged

dist/core/tools/execute-command.tool.jsView file

Lines 1-47javascript

1import { z } from 'zod';

2import { BaseTool } from './tool.interface.js';

3import { exec } from 'child_process';

4import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

5const ExecuteCommandSchema = z.object({

6 command: z.string().optional().describe('The shell command line to run on the system.'),

7 cmd: z.union([z.string(), z.array(z.string())]).optional().describe('Alias for command (can be string or array of command parts).'),

8 workingDirectory: z.string().optional().describe('The working directory to run the command in.'),

9});

10export class ExecuteCommandTool extends BaseTool {

11 name = 'execute_command';

12 description = 'Executes a shell command on the host operating system.';

13 inputSchema = ExecuteCommandSchema;

14 async execute(args) {

15 let rawCommand = args.command || '';

16 if (!rawCommand && args.cmd) {

17 if (Array.isArray(args.cmd)) {

18 rawCommand = args.cmd.join(' ');

19 }

20 else {

21 rawCommand = args.cmd;

22 }

23 }

24 let command = rawCommand.trim();

25 if (!command) {

26 return 'Error: Missing required parameter "command" or "cmd".';

27 }

28 // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd)

29 if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

30 let actualCmd = '';

31 if (command.startsWith('bash -lc '))

32 actualCmd = command.slice(9).trim();

33 else if (command.startsWith('sh -lc '))

34 actualCmd = command.slice(7).trim();

35 else

36 actualCmd = command.slice(8).trim(); // bash -c or sh -c (8 chars)

37 if ((actualCmd.startsWith('"') && actualCmd.endsWith('"')) ||

38 (actualCmd.startsWith("'") && actualCmd.endsWith("'"))) {

39 actualCmd = actualCmd.slice(1, -1);

40 }

41 command = actualCmd;

42 }

43 // 1. Basic Safety/Destructive Keyword Check

44 const destructiveKeywords = ['rm -rf /', 'rm -rf *', 'format ', 'del /f /s /q'];

45 const isDestructive = destructiveKeywords.some((kw) => command.includes(kw));

46 if (isDestructive) {

47 return `Error: Command execution rejected. Blocked destructive keyword match in: '${command}'`;

dist/core/plugins/plugin.manager.jsView file

Lines 20-60javascript

20 this.pluginsPath = path.join(homeDir, '.nexus-node', 'plugins');

21 }

22 }

23 /**

24 * Scans plugin directory and dynamically loads all plugins.

25 */

26 async

dist/core/tools/browser.tool.jsView file

Lines 7-47javascript

7 action: z.enum(['navigate', 'click', 'fill', 'screenshot', 'extract_text']).describe('The action to perform in the browser.'),

8 url: z.string().optional().describe

skill/scripts/comment.pyView file

•path = skill/scripts/comment.py kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/comment.pyView on unpkg

dist/core/mcp/mcp.client.jsView file

•matchType = normalized_sha256 matchedPackage = pks-nexus-cli@1.0.33 matchedPath = dist/core/mcp/mcp.client.js matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.33 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/mcp/mcp.client.jsView on unpkg

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.34 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.34 similarity = 0.904 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg