titan-agent@7.1.0: Suspicious npm security report (Warn)

Loading npm security reports…

titan-agent@7.1.0: Suspicious npm security report (Warn) | LPM Firewall

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json runs a postinstall hook.
scripts/postinstall.cjs creates ~/.titan/install-marker.json on every install.
Global TTY installs automatically launch `titan onboard`.
dist/agent/generator.js generates, compiles, imports, and smoke-executes AI-produced skills.
dist/agent/adapters/codex.js can invoke an installed Codex CLI for agent tasks.

Evidence against

Postinstall performs no network request and writes only TITAN's own ~/.titan marker.
Onboarding network key checks occur after interactive user input.
Telemetry is disabled by default in dist/config/schema.js.
dist/analytics/collector.js sends install telemetry only when telemetry is enabled.
No source evidence of foreign AI-agent config mutation, credential harvesting, or stealth payload execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 640 file(s), 7.62 MB of source, external domains: 127.0.0.1, 192.168.1.100, 192.168.1.50, accounts.google.com, aistudio.google.com, api-inference.huggingface.co, api.01.ai, api.ai21.com, api.anthropic.com, api.capsolver.com, api.cerebras.ai, api.cohere.com, api.deepinfra.com, api.deepseek.com, api.dev.runwayml.com, api.endpoints.anyscale.com, api.fireworks.ai, api.github.com, api.groq.com, api.hunter.io, api.inflection.ai, api.line.me, api.linear.app, api.minimax.chat, api.mistral.ai, api.moonshot.ai, api.novita.ai, api.npmjs.org, api.openai.com, api.perplexity.ai, api.reka.ai, api.replicate.com, api.sambanova.ai, api.telegram.org, api.together.xyz, api.twitter.com, api.venice.ai, api.weather.gov, api.x.ai, babeljs.io, build.nvidia.com, cdn.jsdelivr.net, chat.googleapis.com, console.anthropic.com, console.cloud.google.com, developers.cloudflare.com, discord.com, dj-z690-steel-legend-d5.tail57901.ts.net, docs.titanframework.ai, eu.i.posthog.com

Oversized source lightweight scan

ui/dist/babel.min.js2.99 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinifiedUrlStringsbabeljs.iogithub.com

Source & flagged code

19 flagged

package.jsonView file

Lines 22-62json

22 "ui/dist/",

23 "assets/personas/",

24 "assets/role-bundles/",

25 "assets/widget-templates/",

26 "assets/agent-skills/",

27 "scripts/postinstall.cjs",

28 "README.md",

29 "LICENSE",

30 "THIRD_PARTY_NOTICES.md",

31 ".env.example"

32 ],

33 "main": "dist/cli/index.js",

34 "bin": {

35 "titan": "dist/cli/index.js"

36 },

37 "scripts": {

38 "gitnexus:rebuild": "node /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js analyze --name TITAN",

39 "gitnexus:query": "node /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js query",

40 "gitnexus:status": "node /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js status",

41 "build:ui": "cd ui && npm install && npm run build",

42 "postinstall": "node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L42

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "build": "tsup",

44 "build:personal": "node scripts/build-personal.cjs",

45 "dev": "tsx src/cli/index.ts",

46 "dev:gateway": "tsx src/cli/index.ts gateway",

47 "dev:onboard": "tsx src/cli/index.ts onboard",

48 "dev:doctor": "tsx src/cli/index.ts doctor",

49 "start": "node dist/cli/index.js",

50 "lint": "eslint src/ --ext .ts",

51 "lint:fix": "eslint src/ --ext .ts --fix",

52 "test": "vitest run --reporter=default",

53 "test:watch": "vitest",

54 "test:coverage": "vitest run --coverage",

55 "test:e2e": "npx playwright test",

56 "test:e2e:ui": "npx playwright test --ui",

57 "test:e2e:debug": "npx playwright test --debug",

58 "test:e2e:report": "npx playwright show-report",

59 "benchmark": "tsx scripts/benchmark.ts",

60 "benchmark:dry": "tsx scripts/benchmark.ts --dry-run",

61 "eval": "tsx scripts/agent-eval-v2.ts",

62 "eval:verbose": "tsx scripts/agent-eval-v2.ts --verbose",

dist/agent/stagingScanners.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { existsSync, readFileSync, readdirSync, statSync } from "fs";

3import { join } from "path";

4import logger from "../utils/logger.js";

5const COMPONENT

dist/mesh/discovery.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync } from "child_process";

3import { hostname } from "os";

High

Child Process

Package source references child process execution.

dist/mesh/discovery.jsView on unpkg · L1

4import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs"

dist/addons/paperclipSidecar.jsView file

Lines 60-100javascript

60 }

61 const env = {

62 ...process.env,

63 PATH: currentPath.includes(npmGlobalBin) ? currentPath : `${npmGlobalBin}:${currentPath}`,

ui/dist/assets/TitanCanvas-CmLy7p2N.jsView file

Lines 199-239javascript

199 const babelResult = Babel.transform(src, { presets: [['react', { runtime: 'classic' }]], filename: 'widget.tsx' });

200 code = babelResult.code;

201 console.log('[sandbox] babel ok, code length:', code.

ui/dist/react-dom.development.jsView file

10(function (global, factory) { L11: typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('react')) : L12: typeof define === 'function' && define.amd ? define(['exports', 'react'], factory) :

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ui/dist/react-dom.development.jsView on unpkg · L10

dist/skills/registry.jsView file

Lines 70-110javascript

70 }

71 const disabled = loadDisabledSkills();

72 const idx = disabled.indexOf(skillName);

73 if (enabled && idx >=

dist/agent/playbooks.jsView file

76try { L77: const parsed = JSON.parse(readFileSync(p, "utf-8")); L78: if (parsed.schemaVersion !== 1) return null; ... L135: const key = signatureHash(sig); L136: const bucket = buckets.get(key) || { signature: sig, data: [] }; L137: bucket.data.push(r);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/playbooks.jsView on unpkg · L76

dist/skills/scanner.jsView file

9{ rule: "REVERSE_SHELL", pattern: /bash\s+-i\s+>&\s*\/dev\/tcp/i, description: "Reverse shell detected (bash TCP redirect)" }, L10: { rule: "REVERSE_SHELL", pattern: /nc\s+-e\s+\S+\s+\d{1,5}/i, description: "Reverse shell detected (netcat -e)" }, L11: { rule: "REVERSE_SHELL", pattern: /python.*socket.*connect.*subprocess/is, description: "Python reverse shell pattern" }, ... L15: // Credential theft L16: { rule: "CREDENTIAL_THEFT", pattern: /\.ssh\/id_rsa|\.ssh\/authorized_keys/i, description: "SSH key access attempt" }, L17: { rule: "CREDENTIAL_THEFT", pattern: /\/etc\/shadow|\/etc\/passwd/i, description: "System credential file access" }, ... L27: // Obfuscation L28: { rule: "OBFUSCATION", pattern: /eval\s*\(\s*(?:Buffer\.from|atob|decodeURIComponent)\s*\(/i, description: "Encoded ev

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/skills/scanner.jsView on unpkg · L9

dist/skills/builtin/fb_autopilot.jsView file

40try { L41: const state = JSON.parse(readFileSync(STATE_PATH, "utf-8")); L42: state.truthRejects = Number(state.truthRejects ?? 0); ... L328: if (!enabled) return; L329: if (!process.env.FB_PAGE_ACCESS_TOKEN || !process.env.FB_PAGE_ID) { L330: logger.debug(COMPONENT, "Facebook credentials not configured \u2014 skipping"); ... L544: try { L545: const feedResp = await fetch( L546: `https://graph.facebook.com/v21.0/${pageId}/feed?fields=id,comments{id,message,from,created_time}&limit=5&access_token=${token}`, ... L593: headers: { "Content-Type": "application/json" }, L594: body: JSON.stringify({ message: safeReply, access_token: token }), L595: signal: AbortSignal.timeout(15e3)

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/skills/builtin/fb_autopilot.jsView on unpkg · L40

dist/analytics/posthog.jsView file

16function resolvePostHogHost(now) { L17: if (process.env.TITAN_POSTHOG_HOST) return process.env.TITAN_POSTHOG_HOST; L18: const tz = (() => { ... L20: try { L21: return Intl.DateTimeFormat().resolvedOptions().timeZone; L22: } catch { ... L26: if (EU_TIMEZONE_REGEX.test(tz) || EU_ADJACENT_ZONES.has(tz)) { L27: return "https://eu.i.posthog.com"; L28: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/analytics/posthog.jsView on unpkg · L16

dist/skills/builtin/knowledge_base.jsView file

47const normalized = normalize(filePath); L48: const home = homedir(); L49: const tmp = tmpdir(); ... L116: const raw = readFileSync(join(collectionDir, file), "utf-8"); L117: docs.push(JSON.parse(raw)); L118: } catch { ... L141: source: { type: "string", description: "Where the content came from (URL, file path, etc.)" }, L142: metadata: { type: "object", description: "Additional metadata (tags, date, author, etc.)" } L143: }, ... L262: try { L263: const response = await fetch(url, { L264: headers: { "User-Agent": "Mozilla/5.0 (compatible; TITAN Knowledge Base)" },

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/skills/builtin/knowledge_base.jsView on unpkg · L47

dist/agent/generator.jsView file

97try { L98: execFileSync("npx", ["tsc", tsFilePath, "--module", "NodeNext", "--moduleResolution", "NodeNext", "--target", "ES2022"], { stdio: "pipe" }); L99: logger.info(COMPONENT, `Compiled ${finalName}.ts successfully.`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/agent/generator.jsView on unpkg · L97

assets/agent-skills/idea-refine/scripts/idea-refine.shView file

•path = assets/agent-skills/idea-refine/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/agent-skills/idea-refine/scripts/idea-refine.shView on unpkg

ui/dist/babel.min.jsView file

•path = ui/dist/babel.min.js kind = oversized_source_file sizeBytes = 3137678 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

ui/dist/babel.min.jsView on unpkg

dist/cli/onboard.jsView file

443patternName = generic_password severity = medium line = 443 matchedText = config.g... });

Medium

Secret Pattern

Hardcoded password in dist/cli/onboard.js

dist/cli/onboard.jsView on unpkg · L443

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/agent/stagingScanners.jsView file

20patternName = private_key_rsa severity = critical line = 20 matchedText = { name: ..." },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/agent/stagingScanners.jsView on unpkg · L20

20patternName = private_key_rsa severity = critical line = 20 matchedText = { name: ..." },

Critical

Secret Pattern

RSA private key in dist/agent/stagingScanners.js

dist/agent/stagingScanners.jsView on unpkg · L20

dist/mesh/discovery.jsView file

1#!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import { hostname } from "os";

High

Child Process

Package source references child process execution.

dist/mesh/discovery.jsView on unpkg · L1

dist/addons/paperclipSidecar.jsView file

80stdio: ["pipe", "pipe", "pipe", "ipc"], L81: execArgv: ["--import", "tsx"] L82: });

High

Shell

Package source references shell execution.

dist/addons/paperclipSidecar.jsView on unpkg · L80

61const env = { L62: ...process.env, L63: PATH: currentPath.includes(npmGlobalBin) ? currentPath : `${npmGlobalBin}:${currentPath}`, ... L73: const titanPort = process.env.PORT || "48420"; L74: env.CORS_ORIGIN = `http://localhost:${titanPort}`; L75: logger.info(COMPONENT, `Starting Paperclip server on port ${config.port}...`); L76: try { L77: childProcess = fork(serverEntry, [], { L78: cwd: paperclipDir,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/addons/paperclipSidecar.jsView on unpkg · L61

ui/dist/assets/TitanCanvas-CmLy7p2N.jsView file

219try { L220: const fn = new Function('React', 'ReactDOM', 'titan', code + '\\n' + returnChecks); L221: Widget = fn(React, ReactDOM, titan);

Low

Eval

Package source references a known benign dynamic code generation pattern.

ui/dist/assets/TitanCanvas-CmLy7p2N.jsView on unpkg · L219

ui/dist/react-dom.development.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ui/dist/react-dom.development.jsView on unpkg · L10

dist/skills/registry.jsView file

90if (existsSync(DISABLED_SKILLS_PATH)) { L91: result = JSON.parse(readFileSync(DISABLED_SKILLS_PATH, "utf-8")); L92: } ... L458: logger.info(COMPONENT, `Loaded ${registeredSkills.size} built-in skills`); L459: if (process.env.NODE_ENV !== "production" || process.env.TITAN_DEV) { L460: const { initDevSkills } = await import("./dev/loader.js");

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/skills/registry.jsView on unpkg · L90

dist/agent/playbooks.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/playbooks.jsView on unpkg · L76

dist/skills/scanner.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/skills/scanner.jsView on unpkg · L9

dist/skills/builtin/fb_autopilot.jsView file

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/skills/builtin/fb_autopilot.jsView on unpkg · L40

dist/analytics/posthog.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/analytics/posthog.jsView on unpkg · L16

dist/skills/builtin/knowledge_base.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/skills/builtin/knowledge_base.jsView on unpkg · L47

dist/agent/generator.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/agent/generator.jsView on unpkg · L97

assets/agent-skills/idea-refine/scripts/idea-refine.shView file

•path = assets/agent-skills/idea-refine/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/agent-skills/idea-refine/scripts/idea-refine.shView on unpkg

ui/dist/babel.min.jsView file

•path = ui/dist/babel.min.js kind = oversized_source_file sizeBytes = 3137678 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

ui/dist/babel.min.jsView on unpkg

dist/cli/onboard.jsView file

443patternName = generic_password severity = medium line = 443 matchedText = config.g... });

Medium

Secret Pattern

Hardcoded password in dist/cli/onboard.js

dist/cli/onboard.jsView on unpkg · L443

Source & flagged code

19 flagged

package.jsonView file

Lines 22-62json

22 "ui/dist/",

23 "assets/personas/",

24 "assets/role-bundles/",

25 "assets/widget-templates/",

26 "assets/agent-skills/",

27 "scripts/postinstall.cjs",

28 "README.md",

29 "LICENSE",

30 "THIRD_PARTY_NOTICES.md",

31 ".env.example"

32 ],

33 "main": "dist/cli/index.js",

34 "bin": {

35 "titan": "dist/cli/index.js"

36 },

37 "scripts": {

38 "gitnexus:rebuild": "node /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js analyze --name TITAN",

39 "gitnexus:query": "node /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js query",

40 "gitnexus:status": "node /opt/homebrew/lib/node_modules/gitnexus/dist/cli/index.js status",

41 "build:ui": "cd ui && npm install && npm run build",

42 "postinstall": "node -e \"try{require('./scripts/postinstall.cjs')}catch(e){if(e.code==='MODULE_NOT_FOUND'){console.log('TITAN installed. Run: titan onboard')}else{throw e}}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L42

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

43 "build": "tsup",

44 "build:personal": "node scripts/build-personal.cjs",

45 "dev": "tsx src/cli/index.ts",

46 "dev:gateway": "tsx src/cli/index.ts gateway",

47 "dev:onboard": "tsx src/cli/index.ts onboard",

48 "dev:doctor": "tsx src/cli/index.ts doctor",

49 "start": "node dist/cli/index.js",

50 "lint": "eslint src/ --ext .ts",

51 "lint:fix": "eslint src/ --ext .ts --fix",

52 "test": "vitest run --reporter=default",

53 "test:watch": "vitest",

54 "test:coverage": "vitest run --coverage",

55 "test:e2e": "npx playwright test",

56 "test:e2e:ui": "npx playwright test --ui",

57 "test:e2e:debug": "npx playwright test --debug",

58 "test:e2e:report": "npx playwright show-report",

59 "benchmark": "tsx scripts/benchmark.ts",

60 "benchmark:dry": "tsx scripts/benchmark.ts --dry-run",

61 "eval": "tsx scripts/agent-eval-v2.ts",

62 "eval:verbose": "tsx scripts/agent-eval-v2.ts --verbose",

dist/agent/stagingScanners.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { existsSync, readFileSync, readdirSync, statSync } from "fs";

3import { join } from "path";

4import logger from "../utils/logger.js";

5const COMPONENT

dist/mesh/discovery.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execFileSync } from "child_process";

3import { hostname } from "os";

High

Child Process

Package source references child process execution.

dist/mesh/discovery.jsView on unpkg · L1

4import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs"

dist/addons/paperclipSidecar.jsView file

Lines 60-100javascript

60 }

61 const env = {

62 ...process.env,

63 PATH: currentPath.includes(npmGlobalBin) ? currentPath : `${npmGlobalBin}:${currentPath}`,

ui/dist/assets/TitanCanvas-CmLy7p2N.jsView file

Lines 199-239javascript

199 const babelResult = Babel.transform(src, { presets: [['react', { runtime: 'classic' }]], filename: 'widget.tsx' });

200 code = babelResult.code;

201 console.log('[sandbox] babel ok, code length:', code.

ui/dist/react-dom.development.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ui/dist/react-dom.development.jsView on unpkg · L10

dist/skills/registry.jsView file

Lines 70-110javascript

70 }

71 const disabled = loadDisabledSkills();

72 const idx = disabled.indexOf(skillName);

73 if (enabled && idx >=

dist/agent/playbooks.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/playbooks.jsView on unpkg · L76

dist/skills/scanner.jsView file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/skills/scanner.jsView on unpkg · L9

dist/skills/builtin/fb_autopilot.jsView file

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/skills/builtin/fb_autopilot.jsView on unpkg · L40

dist/analytics/posthog.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/analytics/posthog.jsView on unpkg · L16

dist/skills/builtin/knowledge_base.jsView file

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/skills/builtin/knowledge_base.jsView on unpkg · L47

dist/agent/generator.jsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/agent/generator.jsView on unpkg · L97

assets/agent-skills/idea-refine/scripts/idea-refine.shView file

•path = assets/agent-skills/idea-refine/scripts/idea-refine.sh kind = build_helper sizeBytes = 342 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/agent-skills/idea-refine/scripts/idea-refine.shView on unpkg

ui/dist/babel.min.jsView file

•path = ui/dist/babel.min.js kind = oversized_source_file sizeBytes = 3137678 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

ui/dist/babel.min.jsView on unpkg

dist/cli/onboard.jsView file

443patternName = generic_password severity = medium line = 443 matchedText = config.g... });

Medium

Secret Pattern

Hardcoded password in dist/cli/onboard.js

dist/cli/onboard.jsView on unpkg · L443

titan-agent@7.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code