registry / AI-agent control-surface risk / @agentgates/cli

@agentgates/cli

Wallet operations for AI agents and humans

This report shows the evidence for @agentgates/cli@0.74.0. 21 of 25 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 26d ago · by lpm-firewall-ai

The postinstall hook unconsentingly rewrites foreign global AI-agent instruction files for Claude Code, Cursor, and Windsurf. That is a concrete control-surface hijack, not a user-invoked first-party plugin setup.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install lifecycle postinstall, which runs node scripts/postinstall.mjs even when the script fails.

Impact

Installed coding agents can be steered into package-controlled wallet, key, and password flows without a user consent step.

Mechanism

The script detects ~/.claude, ~/.cursor, and ~/.windsurfrules, then creates or rewrites marked instruction blocks that tell the agent to use the agentgates CLI instead of other tools.

Policy narrative

Installing @agentgates/cli runs a postinstall script that looks for Claude Code, Cursor, and Windsurf configuration in the user home directory. When those surfaces exist, it writes a persistent instruction block telling the agent to route balance, send, swap, and password tasks through the agentgates command. The install does not ask for consent, and hook failures are swallowed so the package still installs.

AI rationale

Evidence

package.jsonscripts/postinstall.mjs~/.claude/CLAUDE.md~/.cursor/rules/agentgates.md~/.windsurfrules

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 93.0% confidence with low false-positive risk.

Evidence for policy risk

npm postinstall runs scripts/postinstall.mjs and ignores failures with exit 0.
If ~/.claude exists, install writes or replaces a marked block in ~/.claude/CLAUDE.md with no consent prompt.
If ~/.cursor exists, install creates ~/.cursor/rules and writes agentgates.md.
If ~/.windsurfrules exists, install appends or replaces the same instruction block.
The injected text tells the coding agent to prefer the agentgates CLI for wallet and password operations.

Evidence against

Writes are skipped when the matching agent home directory or Windsurf rules file is absent.
The published dependency list does not include a runtime self-dependency on this package name.
The bin entry only loads dist/cli.mjs when the user runs the agentgates command.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetwork

Supply chain

HighEntropyStrings

Source & flagged code

12 flagged

package.jsonView file

Lines 17-57json

17 "license": "MIT",

18 "homepage": "https://agentgates.ai",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/Carlos-Sotop/agentgates-ai-cli.git"

22 },

23 "author": "Agentgates",

24 "type": "module",

25 "bin": {

26 "agentgates": "bin/agentgates"

27 },

28 "files": [

29 "bin",

30 "dist/cli.mjs",

31 "scripts/postinstall.mjs",

32 "README.md"

33 ],

34 "scripts": {

35 "build": "esbuild src/main.ts --bundle --platform=node --format=esm --outfile=dist/cli.mjs --define:process.env.CLI_VERSION=\"\\\"$npm_package_version\\\"\" --banner:js=\"import{createRequire}from'module';const require=createRequire(import.meta.url);\"",

36 "build:tsc": "tsc -p tsconfig.json",

37 "postinstall": "node scripts/postinstall.mjs || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "prepare": "[ -x node_modules/.bin/esbuild ] && npm run build || true",

39 "dev": "tsc -w -p tsconfig.json",

40 "typecheck": "tsc --noEmit",

41 "test": "tsc -p tsconfig.json && node --test test/*.test.mjs",

42 "bounty": "node bin/bounty",

43 "sync:bounty-shared": "node scripts/sync-bounty-shared.mjs",

44 "clean": "rm -rf dist"

45 },

46 "engines": {

47 "node": ">=20"

48 },

49 "devDependencies": {

50 "@solana/web3.js": "^1.98.4",

51 "@types/node": "^22.10.0",

52 "commander": "^12.1.0",

53 "esbuild": "^0.28.0",

54 "ethers": "^6.16.0",

55 "open": "^10.1.0",

56 "picocolors": "^1.1.1",

57 "typescript": "^5.6.3"

dist/cli.mjsView file

56* Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path8 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str2) => process8.stdout.write(str2), L1033: writeErr: (str2) => process8.stderr.write(str2), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/cli.mjsView on unpkg · L56

56Trigger-reachable chain: manifest.bin -> bin/agentgates -> dist/cli.mjs L56: * Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path8 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str2) => process8.stdout.write(str2), L1033: writeErr: (str2) => process8.stderr.write(str2), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L56

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: function getIpfsGatewayFunc(baseUrl) { return new FetchRequest(`${baseUrl}${match[2]}`); headers["authorization"] = `Basic ${encodeBase64(toUtf8Bytes(this.#creds))}`; * The value that will be sent for the ``Authorization`` header. * Sets an ``Authorization`` for %%username%% with %%password%%. * a custom gateway baseUrl. static createIpfsGatewayFunc(baseUrl) { return getIpfsGatewayFunc(baseUrl);

scripts/postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";

3import { join } from "path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

4import { homedir } from

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

Findings

3 Critical7 High4 Medium6 Low

CriticalWallet Draindist/cli.mjs

CriticalAi Agent Control Hijackscripts/postinstall.mjs

CriticalTrigger Reachable Dangerous Capabilitydist/cli.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighCredential Redirect Persistencedist/cli.mjs

HighObfuscated Payload Loaderdist/cli.mjs

HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/postinstall.mjs

HighSemantic Analysis Limiteddist/cli.mjs

HighKnown Malware Source Similaritydist/cli.mjs

HighKnown Malware Source Fingerprint Signaturedist/cli.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

Affected versions and remediation

This report applies to @agentgates/cli@0.74.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @agentgates/cli@0.74.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-27 14:59:10.102Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

25 known versions

0.74.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 27, 2026, 2:40 PM 0.73.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 27, 2026, 2:41 AM 0.67.0MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 25, 2026, 2:18 AM 0.58.0MaliciousSoft block: AI-agent control surfaceBlockPublished

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code