Loading npm security reports…

run402@4.71.0: Malicious npm security report (Block) | LPM Firewall

registry / run402 / 4.71.0

run402@4.71.0

CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Runtime room commands harvest the current AI-harness task title and publish it as presence metadata. A lookup command can create that presence automatically.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user or agent runs `run402 rooms who`, `run402 messages send`, or `run402 messages wait` without `--task`.

Impact

Task details and the Codex thread identifier are disclosed to the selected remote organization room without explicit task consent.

Mechanism

Reads the Codex thread store and posts the title with a session identifier.

Attack narrative

When a room-related command runs without `--task`, the package reads the active Codex thread title from the local Codex database. It then sends that title and a session key to a Run402 room presence endpoint. `rooms who` performs this registration even though its interface appears to be a query. The opt-out environment variable does not establish prior consent for this automatic disclosure.

AI rationale

The package contains a concrete runtime data-exfiltration path from an AI-agent control store to a remote service. Its lack of an install hook limits the trigger but does not remove the unconsented disclosure.

Evidence

lib/harness-context.mjslib/rooms-context.mjslib/rooms.mjssdk/dist/namespaces/rooms.js.codex/state_5.sqlite.run402/messaging.json

Network endpoints1

api.run402.com

Source & flagged code

6 flagged · loading source

git-remote-run402.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = run402@4.42.0 matchedIdentity = npm:cnVuNDAy:4.42.0 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

git-remote-run402.mjsView on unpkg

34import net from "node:net"; L35: import { spawn } from "node:child_process"; L36: import { daemonSocketPath, daemonRunnerPath, DAEMON_PROTOCOL_VERSION, cliVersion, forwardableEnv } from "./lib/daemon-path.mjs";

High

Child Process

Package source references child process execution.

git-remote-run402.mjsView on unpkg · L34

sdk/dist/namespaces/credentials.jsView file

145} L146: async import(projectId, opts) { L147: if (!this.client.credentials.saveProject) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

sdk/dist/namespaces/credentials.jsView on unpkg · L145

lib/buzz-doctor.test.mjsView file

23const executable = join(directory, "buzz"); L24: writeFileSync(executable, "#!/bin/sh\nexit 0\n"); L25: chmodSync(executable, 0o755); ... L28: L29: function commandOk(stdout = "") { L30: return { status: 0, stdout, stderr: "" }; ... L79: readMetaImpl: () => ({ name: "buzz-fizz", rail: "x402" }), L80: apiOrigin: "https://api.run402.com", L81: consoleOrigin: "https://console.run402.com", ... L93: it("accepts an explicit hex or npub target and rejects malformed/repeated combinations before probing", () => { L94: const npub = bech32.encode("npub", bech32.toWords(Buffer.from(SUBJECT, "hex"))); L95: assert.deepEqual(parseBuzzDoctorArgs(["--buzz", "--buzz-agent", SUBJECT]), { buzz: true, expectedSubjectHex: SUBJECT });

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/buzz-doctor.test.mjsView on unpkg · L23

lib/dev.mjsView file

109// Astro's normal output. L110: const child = spawn("npx", ["astro", "dev", "--port", port, "--host", host], { L111: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dev.mjsView on unpkg · L109

lib/doctor-source-scan.test.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/doctor-source-scan.test.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged

git-remote-run402.mjsView file

Lines 14-54javascript

14 * - The daemon is never load-bearing: any failure to use it — absent,

15 * busy, stale, mismatched, dying mid-handshake — falls back silently to

16 * the in-process path. The handshake completes BEFORE this client

17 * commits to the daemon (before one byte of stdin is consumed), so

18 * fallback never replays a half-consumed session.

19 * - The fast path stays THIN, mechanically: its import graph is node

20 * builtins + `./lib/daemon-path.mjs` only, pinned by a source-level

21 * gate test (design D7). The heavy graph loads only on fallback.

22 * - `RUN402_DAEMON=0` disables the daemon entirely (dev/CI toggle,

23 * positively named, default on, only "0" disables); any other value

24 * behaves as unset.

25 *

26 * The remote-helper doctrine (fail-closed repository resolution, wallet

27 * selection, protocol semantics) lives with the session implementation in

28 * `cli/lib/remote-helper-session.mjs` — ONE implementation, two hosts.

29 */

30

31import { realpathSync } from "node:fs";

32import { pathToFileURL } from "node:url";

33import * as nodeModule from "node:module";

34import net from "node:net";

35import { spawn } from "node:child_process";

36import { daemonSocketPath, daemonRunnerPath, DAEMON_PROTOCOL_VERSION, cliVersion, forwardableEnv } from "./lib/daemon-path.mjs";

High

Child Process

Package source references child process execution.

git-remote-run402.mjsView on unpkg · L34

37

38// gitvault-startup-amortization (D2): on-disk V8 compile cache for every

39// module loaded from here on. Feature-guarded (Node 22.8+) and try/caught

40// (a read-only install dir degrades silently).

41try {

42 nodeModule.enableCompileCache?.();

43} catch {

44 /* silent by contract */

45}

46

47const CONNECT_TIMEOUT_MS = 250;

48const HANDSHAKE_TIMEOUT_MS = 750;

49

50/** Frame codec: newline-delimited JSON; binary rides base64. */

51function frame(obj) {

52 return `${JSON.stringify(obj)}\n`;

53}

54

•matchType = previous_version_dangerous_delta matchedPackage = run402@4.42.0 matchedIdentity = npm:cnVuNDAy:4.42.0 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

git-remote-run402.mjsView on unpkg

sdk/dist/namespaces/credentials.jsView file

Lines 125-165javascript

125}

126export class ProjectKeysCache {

127 client;

128 constructor(client) {

129 this.client = client;

130 }

lib/buzz-doctor.test.mjsView file

Lines 3-43javascript

3import { tmpdir } from "node:os";

4import { join } from "node:path";

5import { describe, it } from "node:test";

6import { bech32 } from "@scure/base";

lib/dev.mjsView file

Lines 89-129javascript

89 });

90 }

91 if (!process.env.RUN402_SERVICE_KEY) {

92 fail({

93 code: "BAD_USAGE",

94 message: "Missing RUN402_SERVICE_KEY.",

95 hint: "Add it to .env.local. Get the service key from 'run402 projects list' or your Run402 dashboard."

lib/doctor-source-scan.test.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/doctor-source-scan.test.mjs#virtual:normalized:round1View on unpkg