Loading npm security reports…

@agentgates/cli@0.16.0: AI-agent control-surface risk | LPM Firewall

registry / @agentgates/cli / 0.16.0

@agentgates/cli@0.16.0

Wallet operations for AI agents and humans

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a script that alters multiple AI-agent control files in the user's home directory. The injected content directs agents to use commands for wallet transfers and autonomous password use.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation executes postinstall.

Impact

An AI agent may be persistently steered toward financial and credential-handling commands without the user's consent.

Mechanism

Install-time modification of AI-agent instruction files.

Policy narrative

On installation, the package invokes scripts/postinstall.mjs. It detects Claude Code, Cursor, and Windsurf locations and injects a persistent instruction block. That block directs agents away from MCP tools and toward this package's wallet, transfer, and password commands, including language about operation without a human. This is unconsented install-time mutation of foreign AI-agent control surfaces.

Rationale

The automatic postinstall hook modifies several unrelated AI-agent instruction surfaces and inserts directives for wallet and password capabilities. This is concrete AI-agent control hijacking, not user-invoked setup.

Evidence

package.jsonscripts/postinstall.mjs~/.claude/CLAUDE.md~/.cursor/rules/agentgates.md~/.windsurfrules

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli.mjsView file

56* Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path6 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str) => process8.stdout.write(str), L1033: writeErr: (str) => process8.stderr.write(str), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/cli.mjsView on unpkg · L56

56Trigger-reachable chain: manifest.bin -> bin/agentgates -> dist/cli.mjs L56: * Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path6 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str) => process8.stdout.write(str), L1033: writeErr: (str) => process8.stderr.write(str), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L56

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); return url.host === null || url.host === "" || url.cannotBeABaseURL || url.scheme === "file"; cannotBeABaseURL: false this.url.cannotBeABaseURL = true; if (this.base === null || this.base.cannotBeABaseURL && c !== 35) { } else if (this.base.cannotBeABaseURL && c === 35) {

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

27008var _256n2 = BigInt(256); L27009: var _0x71n2 = BigInt(113); L27010: var SHA3_PI2 = [];

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/cli.mjsView on unpkg · L27008

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @agentgates/cli@0.15.0 matchedPath = dist/cli.mjs matchedIdentity = npm:QGFnZW50Z2F0ZXMvY2xp:0.15.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bea0b2a788e291de signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @agentgates/cli@0.15.0 matchedPath = dist/cli.mjs matchedIdentity = npm:QGFnZW50Z2F0ZXMvY2xp:0.15.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.mjsView on unpkg

56* Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path6 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str) => process8.stdout.write(str), L1033: writeErr: (str) => process8.stderr.write(str), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L56

scripts/postinstall.mjsView file

1#!/usr/bin/env node L2: import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs"; L3: import { join } from "path"; ... L48: if (!existsSync(filePath)) { L49: writeFileSync(filePath, wrapped + "\n", "utf-8"); L50: return "created"; ... L58: ); L59: writeFileSync(filePath, content.replace(re, wrapped), "utf-8"); L60: return "updated"; ... L62: L63: writeFileSync(filePath, content.trimEnd() + "\n\n" + wrapped + "\n", "utf-8"); L64: return "appended";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. ns the lane itself over signed http. \`\`\` agentgates passwords init # mint twelve words + the key (once); --seed "<words>" brings words; agentgates_passwords_seed works too agentgates passwords add --label <name> --host <site> --username <u> --password <p> agentgates passwords allow [--agent <addr>] [--ask-me] # permit yourself, or another agent agentgates passwords use --url https://<site>/login # log in through the box, get the page back agentgates passwords list # what this key holds and may use agentgates passwords invite # print a link a person opens to take the ow

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/postinstall.mjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 17-57json

17 "license": "MIT",

18 "homepage": "https://agentgates.ai",

19 "repository": {

20 "type": "git",

21 "url": "git+https://github.com/Carlos-Sotop/agentgates-ai-cli.git"

22 },

23 "author": "Agentgates",

24 "type": "module",

25 "bin": {

26 "agentgates": "bin/agentgates"

27 },

28 "files": [

29 "bin",

30 "dist/cli.mjs",

31 "scripts/postinstall.mjs",

32 "README.md"

33 ],

34 "scripts": {

35 "build": "esbuild src/main.ts --bundle --platform=node --format=esm --outfile=dist/cli.mjs --banner:js=\"import{createRequire}from'module';const require=createRequire(import.meta.url);\"",

36 "build:tsc": "tsc -p tsconfig.json",

37 "postinstall": "node scripts/postinstall.mjs || exit 0",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "prepare": "[ -x node_modules/.bin/esbuild ] && npm run build || true",

39 "dev": "tsc -w -p tsconfig.json",

40 "typecheck": "tsc --noEmit",

41 "bounty": "node bin/bounty",

42 "sync:bounty-shared": "node scripts/sync-bounty-shared.mjs",

43 "clean": "rm -rf dist"

44 },

45 "engines": {

46 "node": ">=20"

47 },

48 "devDependencies": {

49 "@solana/web3.js": "^1.98.4",

50 "@types/node": "^22.10.0",

51 "commander": "^12.1.0",

52 "esbuild": "^0.28.0",

53 "ethers": "^6.16.0",

54 "open": "^10.1.0",

55 "picocolors": "^1.1.1",

56 "typescript": "^5.6.3"

57 }

dist/cli.mjsView file

56* Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path6 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str) => process8.stdout.write(str), L1033: writeErr: (str) => process8.stderr.write(str), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/cli.mjsView on unpkg · L56

56Trigger-reachable chain: manifest.bin -> bin/agentgates -> dist/cli.mjs L56: * Constructs the CommanderError class L57: * @param {number} exitCode suggested exit code which could be used with process.exit L58: * @param {string} code an id string representing the error ... L982: var EventEmitter = __require("node:events").EventEmitter; L983: var childProcess2 = __require("node:child_process"); L984: var path6 = __require("node:path"); ... L1031: this._outputConfiguration = { L1032: writeOut: (str) => process8.stdout.write(str), L1033: writeErr: (str) => process8.stderr.write(str), ... L1067: * @returns {Command[]} L1068: * @private L1069: */

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L56

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); return url.host === null || url.host === "" || url.cannotBeABaseURL || url.scheme === "file"; cannotBeABaseURL: false this.url.cannotBeABaseURL = true; if (this.base === null || this.base.cannotBeABaseURL && c !== 35) { } else if (this.base.cannotBeABaseURL && c === 35) {

scripts/postinstall.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";

3import { join } from "path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L1

4import { homedir } from