registry / AI-agent control-surface risk / @agent-pattern-labs/leads-rig
@agent-pattern-labs/leads-rig
Agentic public-web lead discovery harness with portable ingest artifacts
This report shows the evidence for @agent-pattern-labs/leads-rig@0.1.9. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented postinstall modification of broad consumer AI-agent control surfaces. This meets the firewall block boundary even without separate credential theft or exfiltration.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install executes `postinstall`
Impact
A package install can alter future agent behavior and configure local MCP commands in unrelated consumer projects.
Mechanism
consumer-project AI-agent configuration and instruction injection
Policy narrative
On installation, `bin/sync.mjs` resolves the consumer project from `INIT_CWD` or the current directory, then creates symlinks from this package into broad AI-agent configuration paths including Cursor, Claude, Codex, OpenCode, Pi, and root MCP configuration. It also rewrites an existing consumer `opencode.json` to reference package-supplied instructions. The injected MCP configuration specifies executable commands, including `npx -y @geometra/mcp@1.61.3`, making this an unconsented install-time mutation of foreign AI-agent control surfaces.
AI rationale
Direct source inspection confirms unconsented postinstall modification of broad consumer AI-agent control surfaces. This meets the firewall block boundary even without separate credential theft or exfiltration.
Evidence
package.jsonbin/sync.mjs.mcp.json.cursor/mcp.json.codex/config.tomlopencode.json.claude/settings.json.claude/agents.opencode/instructions.md.opencode/skills.opencode/agents.pi/skills.pi/promptsAGENTS.harness.mdCLAUDE.harness.md
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- `package.json` defines `postinstall: node bin/sync.mjs`.
- `bin/sync.mjs` selects consumer `INIT_CWD`/working directory.
- Postinstall creates agent-control symlinks under `.cursor`, `.claude`, `.codex`, `.opencode`, `.pi`, and `.mcp.json`.
- `bin/sync.mjs` modifies consumer `opencode.json` to load package instructions.
- Dropped MCP configs invoke `npx -y @geometra/mcp@1.61.3` and `state-trace-mcp`.
Evidence against
- Sync avoids overwriting existing real files or mismatched symlinks.
- No source evidence of credential harvesting, exfiltration, or destructive deletion.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node bin/sync.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/leadharness-crawler.mjsView file
1import { createHash } from 'crypto';
L2: import { lookup, resolveMx } from 'dns/promises';
L3: import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
...
L314:
L315: const html = (await response.text()).slice(0, MAX_BODY_CHARS);
L316: const finalUrl = response.url || pageUrl;
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/leadharness-crawler.mjsView on unpkg · L1bin/sync.mjsView file
1
Findings
1 Critical2 High4 Medium5 Low
CriticalAi Agent Control Hijackbin/sync.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityscripts/batch-orchestrator.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbatch/batch-runner.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/leadharness-crawler.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @agent-pattern-labs/leads-rig@0.1.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing @agent-pattern-labs/leads-rig@0.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.