registry / AI-agent control-surface risk / @adityaaria/spark
@adityaaria/spark
SPARK skills and runtime bootstrap for coding agents
This report shows the evidence for @adityaaria/spark@6.4.1. 1 of 17 known versions is blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete unconsented npm install-time mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No separate exfiltration chain is needed for this verdict.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install
Impact
Unconsented modification of broad AI-agent control surfaces and injected session context.
Mechanism
install-time multi-agent config and hook mutation
Policy narrative
The install lifecycle invokes the installer with no user-selected target. In non-TTY/CI execution it detects installed agent platforms and automatically links or copies SPARK skills, hooks, and plugin files into their project control directories; installed hooks inject SPARK instructions at session start.
AI rationale
This is a concrete unconsented npm install-time mutation of multiple foreign AI-agent control surfaces, which meets the block policy. No separate exfiltration chain is needed for this verdict.
Evidence
package.jsonbin/spark-install.shhooks/session-starthooks/session-start-codex.opencode/plugins/spark.js.claude/skills.codex/skills.cursor/skills.pi/extensions/spark.ts.gitignore
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs bin/spark-install.sh as npm install lifecycle.
- bin/spark-install.sh auto-selects detected agents in non-TTY/CI.
- Installer creates/symlinks skills, hooks, plugins, and manifests in multiple agent config paths.
- Session-start hooks inject bundled skill instructions into agent context.
Evidence against
- No credential harvesting or exfiltration found.
- Network use is limited to npm version checking and an authenticated local companion server.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.install = bash bin/spark-install.sh
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.install = bash bin/spark-install.sh
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgskills/brainstorming/scripts/server.cjsView file
1const crypto = require('crypto');
L2: const http = require('http');
L3: const fs = require('fs');
...
L12: function computeAcceptKey(clientKey) {
L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');
L14: }
...
L84:
L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null;
L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383);
...
L105: const SPARK_VERSION = readSPARKVersion();
L106: const SPARK_BRAND_IMAGE_PATH = path.join(__dirname, '../../../assets/spark-small.svg');
L107: const SPARK_BRAND_IMAGE_URL = 'data:image/svg+xml;base64,' + fs.readFileSync(SPARK_BRAND_IMAGE_PATH).toString('base64');
Findings
3 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPayload In Excluded Dirskills/.system/skill-creator/scripts/init_skill.py
HighKnown Malware Source Similarityskills/writing-skills/render-graphs.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/spark-install.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoskills/brainstorming/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @adityaaria/spark@6.4.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @adityaaria/spark@6.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.