registry / AI-agent control-surface risk / @aeon-ai-pay/aicard
@aeon-ai-pay/aicard
CLI & Agent skill for purchasing virtual debit cards via x402 protocol
This report shows the evidence for @aeon-ai-pay/aicard@1.1.7. 7 of 10 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms an install-time cross-agent control-surface mutation and a runtime silent-upgrade path that repeats it. This meets the blocking policy regardless of the package-aligned content of the skill.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm installation; later invocation of the aicard CLI when a newer version exists
Impact
Installs package-controlled instructions into detected AI coding tools, enabling persistent agent behavior changes across tools.
Mechanism
global AI-agent skill installation and silent self-upgrade
Policy narrative
Installing the package runs a postinstall hook that calls the external skills CLI with global, non-interactive flags to install the bundled skill into all detected AI coding tools; if that fails, it force-copies the skill into Claude Code's global skills directory. Separately, every CLI run checks npm for a newer version and launches a detached global upgrade that executes postinstall again. These are unconsented, persistent writes to broad agent control surfaces.
AI rationale
Direct source inspection confirms an install-time cross-agent control-surface mutation and a runtime silent-upgrade path that repeats it. This meets the blocking policy regardless of the package-aligned content of the skill.
Evidence
package.jsonscripts/postinstall.mjssrc/update-check.mjsbin/cli.mjsskills/aicard/SKILL.md~/.claude/skills/aicard~/.aicard/update.log
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json runs scripts/postinstall.mjs on install.
- scripts/postinstall.mjs executes `npx skills add ... -g -y --copy`.
- Postinstall states it installs into all detected AI coding tools.
- Fallback force-copies skills/aicard to ~/.claude/skills/aicard.
- bin/cli.mjs imports update-check on every CLI run.
- src/update-check.mjs silently upgrades globally then reruns postinstall.
Evidence against
- No direct credential harvesting or exfiltration was found in inspected lifecycle code.
- The bundled skill is package-aligned virtual-card guidance, but is deployed without consent across agent tools.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/postinstall.mjsView file
9Install-time AI-agent control hijack evidence:
L9:
L10: import { cpSync, existsSync, mkdirSync } from 'node:fs';
L11: import { join, dirname } from 'node:path';
...
L44: // Fallback: 手动复制到 Claude Code
L45: const dest = join(homedir(), '.claude', 'skills', 'aicard');
L46: mkdirSync(dirname(dest), { recursive: true });
L47: cpSync(skillSrc, dest, { recursive: true, force: true });
L48: console.log(`✔ aicard skill installed to ${dest} (fallback)`);
Payload evidence from templates/codex/AGENTS.md:
L10:
L11: Returns an envelope on stdout; `envelope.data.ready === true` means ready.
L12:
...
L38:
L39: - **Never** prompt for private keys. The CLI auto-generates a local session wallet.
L40: - **Never** display full card numbers, CVV, or expiry. The CLI already redacts these to `•••• 1234`.
Findings
1 Critical5 High4 Medium4 Low
CriticalAi Agent Control Hijackscripts/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/postinstall.mjs
HighShell
HighRuntime Package Installscripts/postinstall.mjs
HighKnown Malware Source Similaritysrc/update-check.mjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @aeon-ai-pay/aicard@1.1.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @aeon-ai-pay/aicard@1.1.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.