@agent-link/agent@0.1.330: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@agent-link/agent@0.1.330: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-bridge.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/emergency-upgrade.jsView file

4import { join, posix } from 'path'; L5: import { gunzipSync } from 'zlib'; L6: export const RELEASE_MANIFEST_URLS = { L7: latest: 'https://msclaude.ai/files/agent/latest.json', L8: beta: 'https://msclaude.ai/files/agent/beta.json', ... L179: } L180: if (normalizedPath === 'package/package.json') { L181: if (packageIdentity) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/emergency-upgrade.jsView on unpkg · L4

launcher/launcher.cjsView file

7const crypto = require('crypto'); L8: const childProcess = require('child_process'); L9: const { spawn } = childProcess; ... L45: function fail(message) { L46: process.stderr.write(`[AgentLink Launcher] ${message}\n`); L47: process.exitCode = 1; ... L55: function loadPointer(file, versionsRoot) { L56: const value = JSON.parse(fs.readFileSync(file, 'utf8')); L57: if ( ... L182: fs.renameSync(temporary, file); L183: if (process.platform !== 'win32') fs.chmodSync(file, 0o600); L184: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

launcher/launcher.cjsView on unpkg · L7

dist/service.jsView file

1Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/service.js L1: import { execFileSync } from 'child_process'; L2: import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'fs'; ... L15: function getServiceRoot() { L16: return process.env.AGENTLINK_SERVICE_ROOT L17: ? resolve(process.env.AGENTLINK_SERVICE_ROOT) ... L22: } L23: export function getServiceArtifactPath(platform = process.platform) { L24: const root = getServiceRoot(); ... L33: if (platform === 'linux') { L34: return join(homedir(), '.config', 'systemd', 'user', `${SERVICE_NAME}.service`); L35: } ... L281: else if (platform === 'darwin') {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/service.jsView on unpkg · L1

dist/claude.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agent-link/agent@0.1.329 matchedIdentity = npm:QGFnZW50LWxpbmsvYWdlbnQ:0.1.329 similarity = 0.924 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/claude.jsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 17-57json

17 "claude",

18 "claude-code",

19 "cli",

20 "ai-agent",

21 "remote-development"

22 ],

23 "type": "module",

24 "main": "dist/index.js",

25 "types": "dist/index.d.ts",

26 "files": [

27 "dist",

28 "launcher",

29 "scripts",

30 "worker"

31 ],

32 "bin": {

33 "agentlink-client": "dist/cli.js"

34 },

35 "scripts": {

36 "build": "tsc",

37 "postinstall": "node scripts/install-bridge.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 "prepublishOnly": "npm run build",

39 "dev": "tsx watch src/index.ts",

40 "start": "node dist/index.js"

41 },

42 "engines": {

43 "node": ">=18.0.0"

44 },

45 "dependencies": {

46 "@azure/msal-node": "^3.8.10",

47 "commander": "^12.0.0",

48 "cron-parser": "^5.5.0",

49 "js-yaml": "^4.1.1",

50 "marked": "^17.0.6",

51 "node-cron": "^4.2.1",

52 "node-pty": "^1.1.0",

53 "qrcode-terminal": "^0.12.0",

54 "tweetnacl": "^1.0.3",

55 "tweetnacl-util": "^0.15.1",

56 "ws": "^8.16.0"

57 },

dist/emergency-upgrade.jsView file

Lines 1-24javascript

1import { createHash } from 'crypto';

2import { mkdtempSync, rmSync, writeFileSync } from 'fs';

3import { tmpdir } from 'os';

4import { join, posix } from 'path';

launcher/launcher.cjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

3

4const fs = require('fs');

5const os = require('os');

dist/service.jsView file

Lines 1-21javascript

1import { execFileSync } from 'child_process';

2import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'fs';

3import { dirname, join, resolve } from 'path';

4import { homedir } from 'os';

dist/claude.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @agent-link/agent@0.1.329 matchedIdentity = npm:QGFnZW50LWxpbmsvYWdlbnQ:0.1.329 similarity = 0.924 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/claude.jsView on unpkg