Loading npm security reports…

pks-nexus-cli@1.0.54: Malicious npm security report (Block) | LPM Firewall

registry / pks-nexus-cli / 1.0.54

pks-nexus-cli@1.0.54

<div align="center"> <img src="assets/nexus-terminal-demo.png" alt="Nexus CLI Terminal Demo" width="600" /> </div> Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command ex

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Running the CLI silently inventories installed and running applications, then includes that inventory in LLM requests. The default configuration sends those requests to an external workers.dev endpoint.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

User runs nexus chat or the default CLI command.

Impact

Unconsented disclosure of host application and process context to the configured provider.

Mechanism

Silent host inventory injected into remote LLM prompt

Attack narrative

On CLI startup, ReplShell launches a background scan of standard application directories and visible processes without displaying this behavior. After up to three seconds it adds the resulting installed/running-app summary as hidden system context. A normal prompt is then sent to the configured LLM; the package defaults to the external devtoolbox workers.dev provider. This transmits machine inventory unrelated to the user's prompt and without consent.

Rationale

The package has no install hook, but its normal runtime path silently harvests host application/process metadata and transmits it through its default remote LLM request path. This is a concrete unconsented data-exfiltration behavior, not merely an advertised user-invoked agent tool.

Evidence

package.jsondist/cli/repl.jsdist/core/system/system-context.service.jsdist/core/config/config.schema.jsdist/core/llm/llm.service.js/Applications/Applications/Utilities

Source & flagged code

7 flagged · loading source

dist/core/tools/execute-command.tool.jsView file

2import { BaseTool } from './tool.interface.js'; L3: import { exec } from 'child_process'; L4: import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

27} L28: // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd) L29: if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

dist/core/plugins/plugin.manager.jsView file

40// Dynamic Import over ESM file URL L41: const module = await import(fileUrl); L42: // Plugin should export default class or carry a Plugin property

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/plugins/plugin.manager.jsView on unpkg · L40

dist/core/tools/browser.tool.jsView file

27const { execSync } = await import('child_process'); L28: execSync('npx playwright install chromium', { stdio: 'inherit' }); L29: browser = await chromium.launch({ headless: true });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/tools/browser.tool.jsView on unpkg · L27

skill/scripts/comment.pyView file

•path = skill/scripts/comment.py kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/comment.pyView on unpkg

dist/core/mcp/mcp.client.jsView file

•matchType = normalized_sha256 matchedPackage = pks-nexus-cli@1.0.46 matchedPath = dist/core/mcp/mcp.client.js matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/mcp/mcp.client.jsView on unpkg

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.34 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.34 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg

Source & flagged code

7 flagged

dist/core/tools/execute-command.tool.jsView file

Lines 1-47javascript

1import { z } from 'zod';

2import { BaseTool } from './tool.interface.js';

3import { exec } from 'child_process';

4import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

5const ExecuteCommandSchema = z.object({

6 command: z.string().optional().describe('The shell command line to run on the system.'),

7 cmd: z.union([z.string(), z.array(z.string())]).optional().describe('Alias for command (can be string or array of command parts).'),

8 workingDirectory: z.string().optional().describe('The working directory to run the command in.'),

9});

10export class ExecuteCommandTool extends BaseTool {

11 name = 'execute_command';

12 description = 'Executes a shell command on the host operating system.';

13 inputSchema = ExecuteCommandSchema;

14 async execute(args) {

15 let rawCommand = args.command || '';

16 if (!rawCommand && args.cmd) {

17 if (Array.isArray(args.cmd)) {

18 rawCommand = args.cmd.join(' ');

19 }

20 else {

21 rawCommand = args.cmd;

22 }

23 }

24 let command = rawCommand.trim();

25 if (!command) {

26 return 'Error: Missing required parameter "command" or "cmd".';

27 }

28 // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd)

29 if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

30 let actualCmd = '';

31 if (command.startsWith('bash -lc '))

32 actualCmd = command.slice(9).trim();

33 else if (command.startsWith('sh -lc '))

34 actualCmd = command.slice(7).trim();

35 else

36 actualCmd = command.slice(8).trim(); // bash -c or sh -c (8 chars)

37 if ((actualCmd.startsWith('"') && actualCmd.endsWith('"')) ||

38 (actualCmd.startsWith("'") && actualCmd.endsWith("'"))) {

39 actualCmd = actualCmd.slice(1, -1);

40 }

41 command = actualCmd;

42 }

43 // 1. Basic Safety/Destructive Keyword Check

44 const destructiveKeywords = ['rm -rf /', 'rm -rf *', 'format ', 'del /f /s /q'];

45 const isDestructive = destructiveKeywords.some((kw) => command.includes(kw));

46 if (isDestructive) {

47 return `Error: Command execution rejected. Blocked destructive keyword match in: '${command}'`;

dist/core/plugins/plugin.manager.jsView file

Lines 20-60javascript

20 this.pluginsPath = path.join(homeDir, '.nexus-node', 'plugins');

21 }

22 }

23 /**

24 * Scans plugin directory and dynamically loads all plugins.

25 */

26 async

dist/core/tools/browser.tool.jsView file

Lines 7-47javascript

7 action: z.enum(['navigate', 'click', 'fill', 'screenshot', 'extract_text']).describe('The action to perform in the browser.'),

8 url: z.string().optional().describe

skill/scripts/comment.pyView file

•path = skill/scripts/comment.py kind = build_helper sizeBytes = 240 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skill/scripts/comment.pyView on unpkg

dist/core/mcp/mcp.client.jsView file

•matchType = normalized_sha256 matchedPackage = pks-nexus-cli@1.0.46 matchedPath = dist/core/mcp/mcp.client.js matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.46 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/mcp/mcp.client.jsView on unpkg

dist/cli/repl.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pks-nexus-cli@1.0.34 matchedIdentity = npm:cGtzLW5leHVzLWNsaQ:1.0.34 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/repl.jsView on unpkg