totem-llm@0.19.0

⚠ Under review

Totem LLM – Your Private AI. Run a self-hosted AI assistant locally on Linux, macOS, or Windows.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Inspected source shows package-local install setup and search-provider authentication, with no concrete attack established. Required runtime and provider coverage remains unresolved, so manual review is appropriate.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

The package postinstall hook runs during installation; search requests run when the web-search function is used.

Impact

The inspected behavior supports package setup and search. Unresolved source coverage prevents ruling out other relevant behavior.

Mechanism

The hook installs dependencies into package-owned subdirectories and generates a missing Prisma client. The inspected search function sends its configured key to its selected provider.

AI rationale

Evidence

package.jsonscripts/postinstall.mjsserver/endpoints/system.jsserver/utils/agents/aibitat/plugins/web-browsing.js

Decision evidence

public snapshot

AI called this Manual Review at 55.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest declares a postinstall hook that runs scripts/postinstall.mjs; the hook installs production dependencies in the package's server and collector directories and generates a missing Prisma client.
The inspected credential-related routes handle login, account setup, registration, and profile updates; the web-search plugin sends a user-configured search key to the corresponding provider.
Source inspection did not resolve the full required runtime and provider coverage, so the available evidence is insufficient for a clean verdict.

Evidence against

The inspected postinstall behavior is package-local setup, and the inspected search-key transfer is to its configured search provider.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

21 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

server/endpoints/system.jsView file

415patternName = generic_password severity = medium line = 415

Medium

Secret Pattern

Package contains a possible secret pattern.

server/endpoints/system.jsView on unpkg · L415

collector/utils/WhisperProviders/ffmpeg/index.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const path = require("path");

3const { execSync, spawnSync } = require(

collector/middleware/verifyIntegrity.jsView file

1const { CommunicationKey } = require("../utils/comKey"); L2: const RuntimeSettings = require("../utils/runtimeSettings");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

collector/middleware/verifyIntegrity.jsView on unpkg · L1

server/utils/agents/aibitat/plugins/web-browsing.jsView file

40parameters: { L41: $schema: "http://json-schema.org/draft-07/schema#", L42: type: "object", ... L157: _serpApi: async function (query) { L158: if (!process.env.AGENT_SERPAPI_API_KEY) { L159: this.super.introspect( ... L173: L174: const params = new URLSearchParams({ L175: engine: engine, ... L185: .then((res) => { L186: if (res.ok) return res.json(); L187: throw new Error(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server/utils/agents/aibitat/plugins/web-browsing.jsView on unpkg · L40

lib/launcher.jsView file

1Cross-file remote execution chain: lib/launcher.js spawns server/public/index.js; helper contains network access plus dynamic code execution. L1: import { spawn } from "child_process"; L2: import { join } from "path"; ... L67: L68: child.stdout.on("data", (c) => flush(c)); L69: child.stderr.on("data", (c) => flush(c)); ... L78: function getLocalIP() { L79: const interfaces = os.networkInterfaces(); L80: for (const name of Object.keys(interfaces)) { ... L131: // Display startup banner with professional formatting L132: process.stdout.write("\n"); L133: process.stdout.write(startupBanner(appVersion, "production")); ... L150: highlightBox(

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/launcher.jsView on unpkg · L1

server/public/assets/ort-wasm-simd-threaded-DcHrbrbl.wasmView file

•path = server/public/assets/ort-wasm-simd-threaded-DcHrbrbl.wasm kind = wasm_module sizeBytes = 14239897 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

server/public/assets/ort-wasm-simd-threaded-DcHrbrbl.wasmView on unpkg

lib/setup.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/setup.js#virtual:normalized:round1View on unpkg

collector/index.jsView file

•matchType = normalized_sha256 matchedPackage = totem-llm@0.15.1 matchedPath = collector/index.js matchedIdentity = npm:dG90ZW0tbGxt:0.15.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High