registry / vegas-chat / 2.14.2

vegas-chat@2.14.2

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The runtime AI CLI can execute shell commands and launch user-configured MCP server processes. Its Google command can read a downloaded OAuth client-secret file only when the user invokes authentication; no confirmed malicious install-time surface exists.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the vegas CLI and permits model tool calls, configures/auto-loads MCP, or invokes /google auth.

Impact

A malicious prompt, model response, or unsafe user configuration could cause local command execution or access to user-supplied OAuth credentials.

Mechanism

LLM-driven shell execution, configured MCP process launching, and explicit OAuth setup.

Rationale

The package is not confirmed malicious: lifecycle scripts are benign and observed sensitive actions are runtime/user-command features. It warrants a warning because it is a powerful AI-agent CLI with shell, MCP, and OAuth credential-handling capabilities.

Evidence

package.jsondist/index.js~/.vegas/config.json~/.vegas/vegas.db/storage/emulated/0/Download/client_secret_*.json~/Downloads/client_secret_*.json

Network endpoints2

accounts.google.com/o/oauth2/authoauth2.googleapis.com/token

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

dist/index.js exposes an LLM-callable bash tool using node:child_process exec.
dist/index.js starts configured MCP stdio commands and auto-loads configured servers.
dist/index.js scans common Downloads paths for Google client_secret_*.json after explicit /google auth.
dist/index.js exchanges supplied Google OAuth credentials/tokens with Google endpoints.

Evidence against

package.json preinstall only checks Node major version; postinstall only chmods its own dist/index.js.
No install hook modifies AI-agent configs, harvests files, or makes network requests.
Google credential discovery is reached from explicit /google auth, and credentials are stored under ~/.vegas.
Observed network use is package-aligned LLM/OAuth functionality; no exfiltration endpoint or stealth payload was confirmed.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

8 flagged

package.jsonView file

Lines 19-60json

19 },

20 "license": "MIT",

21 "author": "web-kamikaze",

22 "repository": {

23 "type": "git",

24 "url": "git+https://github.com/web-kamikaze/vegas-chat.git"

25 },

26 "bin": {

27 "vegas": "dist/index.js"

28 },

29 "type": "module",

30 "scripts": {

31 "build": "npm run build:dashboard && npm run build:bundle",

32 "build:dashboard": "cd src/router/dashboard && npm install --silent && npx vite build --config ../../../vite.config.ts 2>&1 | tail -5",

33 "build:ts": "tsc",

34 "start": "node dist/index.js",

35 "dev": "tsx src/index.ts",

36 "router": "node -e \"require('./dist/router/use9router.js').start9Router(20128).then(() => console.log('9Router started on port 20128')).catch(e => console.error(e))\"",

37 "lint": "eslint src/ --max-warnings 100",

38 "prepublishOnly": "npm run build",

39 "preinstall": "node -e \"process.exit(process.version.slice(1).split('.')[0] < 18 ? 1 : 0)\" || echo \"vegas requires Node.js >= 18\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L39

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

40 "postinstall": "node -e \"try{require('fs').chmodSync('dist/index.js',0o755)}catch(e){}\"",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "build:bundle": "node scripts/build-bundle.mjs"

42 },

43 "engines": {

44 "node": ">=18.0.0"

45 },

46 "files": [

47 "dist/index.js",

48 "dist/cyberpunk-theme.css",

49 "dist/pintar-instructions.md",

50 "dist/router/cyberpunk-theme.css",

51 "dist/dashboard",

52 "README.md",

53 "LICENSE"

54 ],

55 "devDependencies": {

56 "@types/diff": "^7.0.2",

57 "@types/google.maps": "^3.65.2",

58 "@types/node": "^20.0.0",

59 "@types/react": "^19.2.17",

60 "@typescript-eslint/eslint-plugin": "^8.62.1",

dist/index.jsView file

153. You might have more than one copy of React in the same app L16: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function nt(){We.asyncTransitions--}function Ye(z){if(Na===null)try{var Ce=("requ... L17: `+pe.replace(/^Error(:[^\n]*)?\n/,""))});return se.prototype=Object.create(K.prototype),se.prototype.constructor=se,se.prototype.toString=function(){return this.message===void 0?th... ... L23: `)a&&(o+=_N("")),o+=f9(u);else if(B===` L24: `){let O=[...u];c9(h.slice(_+1),O),o+=A9(O),a&&(o+=_N(a))}_+=B.length}return o}});import Vy from"node:process";import{execFileSync as h9}from"node:child_process";import SC from"nod... L25: at`)?" (<anonymous>)":-1<d.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.bin -> dist/index.js L15: 3. You might have more than one copy of React in the same app L16: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function nt(){We.asyncTransitions--}function Ye(z){if(Na===null)try{var Ce=("requ... L17: `+pe.replace(/^Error(:[^\n]*)?\n/,""))});return se.prototype=Object.create(K.prototype),se.prototype.constructor=se,se.prototype.toString=function(){return this.message===void 0?th... ... L23: `)a&&(o+=_N("")),o+=f9(u);else if(B===` L24: `){let O=[...u];c9(h.slice(_+1),O),o+=A9(O),a&&(o+=_N(a))}_+=B.length}return o}});import Vy from"node:process";import{execFileSync as h9}from"node:child_process";import SC from"nod... L25: at`)?" (<anonymous>)":-1<d.stack.indexOf("@")?"@unknown:0

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "process.exit(process.version.slice(1).split('.')[0] < 18 ? 1 : 0)" || echo "vegas requires Node.js >= 18"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "process.exit(process.version.slice(1).split('.')[0] < 18 ? 1 : 0)" || echo "vegas requires Node.js >= 18"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('fs').chmodSync('dist/index.js',0o755)}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Findings

3 Critical3 High5 Medium6 Low

CriticalRed Install Lifecycle Scriptpackage.json

CriticalSame File Env Network Executiondist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

Low