registry  /  swarmdo  /  1.45.0

swarmdo@1.45.0

Swarmdo - Enterprise AI agent orchestration for Claude Code. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package ships a Claude Code plugin whose configured hooks run on tool events and may invoke the latest Swarmdo package through npx. Its separate interactive installer can add a first-party MCP server to the user's Claude configuration.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
User installs/enables the Claude plugin or explicitly runs its installer; Claude Code then fires configured hooks.
Impact
Hook event data is passed to the Swarmdo CLI; npx fallback can retrieve a newer package version at runtime.
Mechanism
First-party agent-extension hooks with npx latest fallback and interactive MCP configuration.
Rationale
Source inspection does not establish malicious behavior, but it does establish a real first-party AI-agent extension with runtime npx-latest fallback and nested install-time dependency mutation. Warn rather than block under the extension lifecycle policy.
Evidence
package.jsonbin/cli.js.claude-plugin/hooks/hooks.json.claude-plugin/scripts/swarmdo-hook.cjs.claude-plugin/scripts/install.shv3/@swarmdo/cli/scripts/postinstall.cjsv3/@swarmdo/browser/package.json~/.claude/settings.jsonnode_modules/agentdb

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
  • `.claude-plugin/hooks/hooks.json` registers Claude Code PreToolUse/PostToolUse hooks.
  • `.claude-plugin/scripts/swarmdo-hook.cjs` forwards hook stdin to `swarmdo hooks` and falls back to `npx --yes swarmdo@latest`.
  • `.claude-plugin/scripts/install.sh` interactively writes `~/.claude/settings.json` only when the user selects MCP setup.
  • `v3/@swarmdo/cli/scripts/postinstall.cjs` mutates reachable `agentdb` dependency directories at install time.
  • `v3/@swarmdo/browser/package.json` contains a nested postinstall that attempts global `agent-browser` installation.
Evidence against
  • Root `package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
  • `bin/cli.js` only resolves and imports the packaged CLI entrypoint.
  • Plugin installation is an explicit interactive script, not an npm lifecycle action.
  • Inspected postinstall patches only `agentdb` layout/exports; no credential collection, exfiltration, or AI-agent config write was found.
  • No confirmed malicious payload, destructive action, or unauthorized remote command chain was found in inspected files.
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1,483 file(s), 20.3 MB of source, external domains: accounts.google.com, admin.example.com, admin.test.com, agentic-flow.dev, aistudio.google.com, api.anthropic.com, api.cohere.ai, api.npmjs.org, api.openai.com, api.pinata.cloud, api.web3.storage, arxiv.org, claude.com, cli.github.com, cloud.google.com, cloudflare-ipfs.com, console.anthropic.com, crates.io, datasets-server.huggingface.co, dweb.link, edge-net-dashboard-875130704813.us-central1.run.app, edge-net-genesis-875130704813.us-central1.run.app, gateway.pinata.cloud, generativelanguage.googleapis.com, git-scm.com, github.com, gun-eu.herokuapp.com, gun-manhattan.herokuapp.com, gun-us.herokuapp.com, html.duckduckgo.com, hub.docker.com, huggingface.co, ipfs.io, json-schema.org, json.schemastore.org, makersuite.google.com, nodejs.org, oauth2.googleapis.com, ollama.com, openrouter.ai, pi.swarmdo.com, pinata.cloud, raw.githubusercontent.com, registry.npmjs.org, requesty.ai, router.requesty.ai, sh.rustup.rs, sql.js.org, storage.googleapis.com, swarmdo.com

Source & flagged code

29 flagged · loading source
v3/@swarmdo/guidance/dist/manifest-validator.jsView file
702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },
Critical
Critical Secret

Package contains a critical-looking secret pattern.

v3/@swarmdo/guidance/dist/manifest-validator.jsView on unpkg · L702
702patternName = private_key_rsa severity = critical line = 702 matchedText = params: ...' },
Critical
Secret Pattern

RSA private key in v3/@swarmdo/guidance/dist/manifest-validator.js

v3/@swarmdo/guidance/dist/manifest-validator.jsView on unpkg · L702
v3/@swarmdo/swarm/dist/coordination/agent-registry.jsView file
51// ========================================================================== L52: async spawn(agentId) { L53: const definition = this.definitions.get(agentId);
High
Child Process

Package source references child process execution.

v3/@swarmdo/swarm/dist/coordination/agent-registry.jsView on unpkg · L51
v3/@swarmdo/security/dist/safe-executor.jsView file
85* L86: * This class replaces unsafe exec() and spawn({shell: true}) calls L87: * with validated execFile() calls.
High
Shell

Package source references shell execution.

v3/@swarmdo/security/dist/safe-executor.jsView on unpkg · L85
v3/@swarmdo/guidance/dist/analyzer.jsView file
1344patternName = generic_password severity = medium line = 1344 matchedText = { type: ...' },
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/guidance/dist/analyzer.js

v3/@swarmdo/guidance/dist/analyzer.jsView on unpkg · L1344
2127patternName = generic_password severity = medium line = 2127 matchedText = { type: ...' },
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/guidance/dist/analyzer.js

v3/@swarmdo/guidance/dist/analyzer.jsView on unpkg · L2127
2103{ type: 'must-match-pattern', value: 'escape|validate|regex|filter', severity: 'major' }, L2104: { type: 'must-not-contain', value: 'eval(', severity: 'critical' }, L2105: ],
Low
Eval

Package source references a known benign dynamic code generation pattern.

v3/@swarmdo/guidance/dist/analyzer.jsView on unpkg · L2103
bin/cli.jsView file
10const cliPath = join(__dirname, '..', 'v3', '@swarmdo', 'cli', 'bin', 'cli.js'); L11: await import(pathToFileURL(cliPath).href);
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L10
v3/@swarmdo/cli/dist/src/init/statusline-generator.jsView file
18* install with custom prefix, pnpm content-addressable layout, etc.). Walks up L19: * from this module's location until it finds a package.json whose name is L20: * `@swarmdo/cli`. Works in both the src tree (under tsx) and the compiled dist ... L32: try { L33: const pkg = JSON.parse(fs.readFileSync(candidate, 'utf-8')); L34: if (pkg.name === '@swarmdo/cli' && typeof pkg.version === 'string' && pkg.version.length > 0) { ... L85: const path = require('path'); L86: const { execSync } = require('child_process'); L87: const os = require('os'); ... L98: // SWARMDO_STATUSLINE_HIDE_COST 1/true/yes/on removes the segment entirely. L99: costSymbol: process.env.SWARMDO_STATUSLINE_COST_SYMBOL ?? '$', L100: hideCost: /^(1|true|yes|on)$/i.test(process.env.SWARMDO_STATUSLINE_HIDE_COST || ''),
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

v3/@swarmdo/cli/dist/src/init/statusline-generator.jsView on unpkg · L18
v3/@swarmdo/cli/dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View file
49// 1. Environment variable (fastest path, used in test mocks and CI) L50: const envKey = process.env['GOOGLE_AI_API_KEY']; L51: if (envKey) ... L54: try { L55: const { execSync } = await import('node:child_process'); L56: const key = execSync('gcloud secrets versions access latest --secret=GOOGLE_AI_API_KEY --project=swarm-dev 2>/dev/null', { encoding: 'utf-8', timeout: 5_000 }).trim(); ... L62: } L63: throw new Error("grounded_query: No Google AI API key found.\nSet GOOGLE_AI_API_KEY env var, or ensure `gcloud` is authenticated and\nthe secret GOOGLE_AI_API_KEY exists in GCP pro... L64: }
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

v3/@swarmdo/cli/dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1View on unpkg · L49
v3/vendor/swarmvector/bin/cli.jsView file
3// Signal CLI context (disables parallel workers - hooks are short-lived) L4: process.env.SWARMVECTOR_CLI = '1'; L5: ... L124: L125: // Get package version from package.json L126: const packageJson = require('../package.json'); ... L198: try { L199: const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8')); L200: dimension = sanitizeDimension(meta.dimension, 384); ... L327: if (result.metadata) { L328: console.log(chalk.gray(` Metadata: ${JSON.stringify(result.metadata)}`)); L329: }
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

v3/vendor/swarmvector/bin/cli.jsView on unpkg · L3
v3/@swarmdo/codex/dist/initializer.jsView file
300try { L301: execSync('codex mcp add swarmdo -- npx swarmdo mcp start', { L302: stdio: 'pipe',
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

v3/@swarmdo/codex/dist/initializer.jsView on unpkg · L300
v3/@swarmvector/attention/platforms/darwin-arm64/swarmvector-attention.nodeView file
•path = v3/@[redacted]-arm64/swarmvector-attention.node kind = native_binary sizeBytes = 1300240 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

v3/@swarmvector/attention/platforms/darwin-arm64/swarmvector-attention.nodeView on unpkg
v3/@swarmvector/swarmllm-wasm/swarmllm_wasm_bg.wasmView file
•path = v3/@swarmvector/swarmllm-wasm/swarmllm_wasm_bg.wasm kind = wasm_module sizeBytes = 394208 magicHex = [redacted]
Medium
Ships Wasm Module

Package ships WebAssembly modules.

v3/@swarmvector/swarmllm-wasm/swarmllm_wasm_bg.wasmView on unpkg
.claude/statusline-command.shView file
•path = .claude/statusline-command.sh kind = payload_in_excluded_dir sizeBytes = 6227 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/statusline-command.shView on unpkg
•path = .claude/statusline-command.sh kind = build_helper sizeBytes = 6227 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/statusline-command.shView on unpkg
v3/@swarmdo/cli/dist/src/changelog/changelog.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = swarmdo@1.37.0 matchedIdentity = npm:c3dhcm1kbw:1.37.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

v3/@swarmdo/cli/dist/src/changelog/changelog.jsView on unpkg
.claude/agents/core/reviewer.mdView file
67patternName = generic_password severity = medium line = 67 matchedText = console....rd);
Medium
Secret Pattern

Hardcoded password in .claude/agents/core/reviewer.md

.claude/agents/core/reviewer.mdView on unpkg · L67
.claude/agents/sparc/refinement.mdView file
41patternName = generic_password severity = medium line = 41 matchedText = password...23!'
Medium
Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L41
69patternName = generic_password severity = medium line = 69 matchedText = password...ord'
Medium
Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L69
245patternName = generic_password severity = medium line = 245 matchedText = passwo...
Medium
Secret Pattern

Hardcoded password in .claude/agents/sparc/refinement.md

.claude/agents/sparc/refinement.mdView on unpkg · L245
v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.jsView file
809patternName = generic_password severity = medium line = 809 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.js

v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.jsView on unpkg · L809
1662patternName = generic_password severity = medium line = 1662 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.js

v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.jsView on unpkg · L1662
v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.tsView file
58patternName = generic_password severity = medium line = 58 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.ts

v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.tsView on unpkg · L58
194patternName = generic_password severity = medium line = 194 matchedText = * pass...rd',
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.ts

v3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.tsView on unpkg · L194
v3/@swarmdo/aidefence/README.mdView file
337patternName = generic_password severity = medium line = 337 matchedText = | **Pass..."` |
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/aidefence/README.md

v3/@swarmdo/aidefence/README.mdView on unpkg · L337
v3/@swarmdo/cli/.claude/agents/sparc/refinement.mdView file
339patternName = generic_password severity = medium line = 339 matchedText = password...23!'
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/cli/.claude/agents/sparc/refinement.md

v3/@swarmdo/cli/.claude/agents/sparc/refinement.mdView on unpkg · L339
367patternName = generic_password severity = medium line = 367 matchedText = password...ord'
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/cli/.claude/agents/sparc/refinement.md

v3/@swarmdo/cli/.claude/agents/sparc/refinement.mdView on unpkg · L367
543patternName = generic_password severity = medium line = 543 matchedText = passwo...
Medium
Secret Pattern

Hardcoded password in v3/@swarmdo/cli/.claude/agents/sparc/refinement.md

v3/@swarmdo/cli/.claude/agents/sparc/refinement.mdView on unpkg · L543

Findings

3 Critical6 High22 Medium5 Low
CriticalCritical Secretv3/@swarmdo/guidance/dist/manifest-validator.js
CriticalPrevious Version Dangerous Deltav3/@swarmdo/cli/dist/src/changelog/changelog.js
CriticalSecret Patternv3/@swarmdo/guidance/dist/manifest-validator.js
HighChild Processv3/@swarmdo/swarm/dist/coordination/agent-registry.js
HighShellv3/@swarmdo/security/dist/safe-executor.js
HighSame File Env Network Executionv3/@swarmdo/cli/dist/src/benchmarks/gaia-tools/grounded_query.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilityv3/vendor/swarmvector/bin/cli.js
HighRuntime Package Installv3/@swarmdo/codex/dist/initializer.js
HighPayload In Excluded Dir.claude/statusline-command.sh
MediumDynamic Requirebin/cli.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencev3/@swarmdo/cli/dist/src/init/statusline-generator.js
MediumShips Native Binaryv3/@swarmvector/attention/platforms/darwin-arm64/swarmvector-attention.node
MediumShips Wasm Modulev3/@swarmvector/swarmllm-wasm/swarmllm_wasm_bg.wasm
MediumShips Build Helper.claude/statusline-command.sh
MediumStructural Risk Force Deep Review
MediumSecret Pattern.claude/agents/core/reviewer.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Pattern.claude/agents/sparc/refinement.md
MediumSecret Patternv3/@swarmdo/guidance/dist/analyzer.js
MediumSecret Patternv3/@swarmdo/guidance/dist/analyzer.js
MediumSecret Patternv3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.js
MediumSecret Patternv3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.js
MediumSecret Patternv3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.ts
MediumSecret Patternv3/@swarmdo/plugins/dist/integrations/swarmvector/swarmvector-bridge.d.ts
MediumSecret Patternv3/@swarmdo/aidefence/README.md
MediumSecret Patternv3/@swarmdo/cli/.claude/agents/sparc/refinement.md
MediumSecret Patternv3/@swarmdo/cli/.claude/agents/sparc/refinement.md
MediumSecret Patternv3/@swarmdo/cli/.claude/agents/sparc/refinement.md
LowScripts Present
LowEvalv3/@swarmdo/guidance/dist/analyzer.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings