Loading npm security reports…

@aeon-ai-pay/aicard: AI-agent control-surface risk | LPM Firewall

registry / @aeon-ai-pay/aicard / 1.1.7

@aeon-ai-pay/aicard@1.1.7

CLI & Agent skill for purchasing virtual debit cards via x402 protocol

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates broad, foreign AI-agent skill surfaces without a user command. Every CLI invocation can also silently perform a global upgrade that repeats that mutation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation; later invocation of the aicard CLI when a newer version exists

Impact

Installs package-controlled instructions into detected AI coding tools, enabling persistent agent behavior changes across tools.

Mechanism

global AI-agent skill installation and silent self-upgrade

Policy narrative

Installing the package runs a postinstall hook that calls the external skills CLI with global, non-interactive flags to install the bundled skill into all detected AI coding tools; if that fails, it force-copies the skill into Claude Code's global skills directory. Separately, every CLI run checks npm for a newer version and launches a detached global upgrade that executes postinstall again. These are unconsented, persistent writes to broad agent control surfaces.

Rationale

Direct source inspection confirms an install-time cross-agent control-surface mutation and a runtime silent-upgrade path that repeats it. This meets the blocking policy regardless of the package-aligned content of the skill.

Evidence

package.jsonscripts/postinstall.mjssrc/update-check.mjsbin/cli.mjsskills/aicard/SKILL.md~/.claude/skills/aicard~/.aicard/update.log

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

9Install-time AI-agent control hijack evidence: L9: L10: import { cpSync, existsSync, mkdirSync } from 'node:fs'; L11: import { join, dirname } from 'node:path'; ... L44: // Fallback: 手动复制到 Claude Code L45: const dest = join(homedir(), '.claude', 'skills', 'aicard'); L46: mkdirSync(dirname(dest), { recursive: true }); L47: cpSync(skillSrc, dest, { recursive: true, force: true }); L48: console.log(`✔ aicard skill installed to ${dest} (fallback)`); Payload evidence from templates/codex/AGENTS.md: L10: L11: Returns an envelope on stdout; `envelope.data.ready === true` means ready. L12: ... L38: L39: - **Never** prompt for private keys. The CLI auto-generates a local session wallet. L40: - **Never** display full card numbers, CVV, or expiry. The CLI already redacts these to `•••• 1234`.

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.mjsView on unpkg · L9

12import { homedir } from 'node:os'; L13: import { execFileSync } from 'node:child_process'; L14: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L12

3/** L4: * npm install -g 后自动安装 skill 到所有已检测的 AI 编码工具 L5: * ... L12: import { homedir } from 'node:os'; L13: import { execFileSync } from 'node:child_process'; L14: import { fileURLToPath } from 'node:url';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L3

src/update-check.mjsView file

•matchType = normalized_sha256 matchedPackage = @aeon-ai-pay/aicard@1.0.5 matchedPath = src/update-check.mjs matchedIdentity = npm:QGFlb24tYWktcGF5L2FpY2FyZA:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.mjsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "@aeon-ai-pay/aicard",

3 "version": "1.1.7",

4 "description": "CLI & Agent skill for purchasing virtual debit cards via x402 protocol",

5 "type": "module",

6 "bin": {

7 "aicard": "bin/cli.mjs"

8 },

9 "files": [

10 "bin",

11 "src",

12 "skills",

13 "scripts",

14 "docs",

15 "templates",

16 "README.md"

17 ],

18 "scripts": {

19 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 "create": "node bin/cli.mjs create",

21 "status": "node bin/cli.mjs status",

22 "wallet": "node bin/cli.mjs wallet",

23 "release": "node scripts/release.mjs"

24 },

25 "dependencies": {

26 "@aeon-ai-pay/axios": "2.1.2",

27 "@aeon-ai-pay/evm": "2.1.4",

28 "@walletconnect/sign-client": "^2.17.0",

29 "axios": "^1.13.2",

30 "commander": "^13.0.0",

31 "qrcode-terminal": "^0.12.0",

32 "viem": "^2.39.0"

33 },

34 "optionalDependencies": {

35 "playwright": "^1.61.1"

36 },

37 "engines": {

38 "node": ">=18"

39 },

scripts/postinstall.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2

3/**

4 * npm install -g 后自动安装 skill 到所有已检测的 AI 编码工具

5 *

6 * 优先使用 `npx skills add` (Vercel Labs) 统一安装到所有工具

7 * 失败时 fallback 到手动复制 Claude Code skills 目录

8 */

9

10import { cpSync, existsSync, mkdirSync } from 'node:fs';

src/update-check.mjsView file

•matchType = normalized_sha256 matchedPackage = @aeon-ai-pay/aicard@1.0.5 matchedPath = src/update-check.mjs matchedIdentity = npm:QGFlb24tYWktcGF5L2FpY2FyZA:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/update-check.mjsView on unpkg