Loading npm security reports…

@ai-content-space/loopx@0.9.4: AI-agent control-surface risk | LPM Firewall

registry / @ai-content-space/loopx / 0.9.4

@ai-content-space/loopx@0.9.4

Docs-first engineering discipline for agentic coding assistants

AI Security Review

scanned 29d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package triggers a postinstall script that installs skills and appends managed instructions to global Codex and Claude control files. This changes AI-agent behavior without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation with lifecycle scripts enabled

Impact

Future Codex and Claude sessions can consume package-authored instructions and skills.

Mechanism

Postinstall mutation of global AI-agent skill and instruction surfaces

Policy narrative

The package declares a postinstall hook. That hook invokes an installer whose default target list contains both Codex and Claude. The installer copies bundled skills and unconditionally calls the managed-guidance writer for each target, which creates or updates global agent instruction files. This is an automatic mutation of broad, foreign AI-agent control surfaces rather than a user-invoked setup action.

AI rationale

The source establishes an automatic lifecycle chain that writes package-authored instructions into global Codex and Claude control files. Although no exfiltration or remote payload execution was found, this concrete unconsented control-surface mutation meets the blocking policy.

Evidence

package.jsonscripts/install-skills.mjssrc/install-discovery.mjs.agents/skills.claude/skills.codex/AGENTS.md.claude/CLAUDE.md

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/install-discovery.mjsView file

99Install-time AI-agent control hijack evidence: L99: kind: 'plugin', L100: sourceRelativePath: 'plugins/loopx/.codex-plugin/plugin.json', L101: }, ... L127: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L128: return resolve(env.LOOPX_AGENTS_ROOT || join(home, '.agents')); L129: } ... L136: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L137: return resolve(env.LOOPX_CLAUDE_SKILLS_ROOT || join(home, '.claude', 'skills')); L138: } ... L141: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L142: return resolve(env.LOOPX_CLAUDE_SETTINGS_PATH || join(home, '.claude', 'settings.json')); L143: } Payload evidence from [redacted]-features.md: L186: } L187: return ctx.JSON(200, resp) L188: }) ... L295: "kratos-mcp": { L296: "url": "http://loc

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/install-discovery.mjsView on unpkg · L99

•matchType = previous_version_dangerous_delta matchedPackage = @ai-content-space/loopx@0.4.3 matchedIdentity = npm:QGFpLWNvbnRlbnQtc3BhY2UvbG9vcHg:0.4.3 similarity = 0.385 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/install-discovery.mjsView on unpkg

114function jsonClone(value) { L115: return JSON.parse(JSON.stringify(value)); L116: } ... L121: L122: export function getProjectRoot(env = process.env) { L123: return resolve(env.LOOPX_PROJECT_ROOT || PROJECT_ROOT); ... L126: export function getAgentsRoot(env = process.env) { L127: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L128: return resolve(env.LOOPX_AGENTS_ROOT || join(home, '.agents')); ... L278: path, L279: data: { L280: version: 3,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/install-discovery.mjsView on unpkg · L114

src/runtime-maintenance.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { mkdir, rename } from 'node:fs/promises'; import { existssync, readdirsync } from 'node:fs'; import { spawnsync } from 'node:child_process'; import { basename, dirname, join, resolve } from 'node:path'; import { gettemplatebaselinepath, inspectinstallstate, verifyinstallstate } from './install-discovery.mjs'; import { inspecttemplategovernance } from './template-governance.mjs'; import { inspectworkspacecontext } from './workspace-context.mjs'; export function resolveloopxroot(cwd) { return join(resolve(cwd), '.loopx'); } export function resolveuppercaseloopxroot(cwd) { return join(resolve(cwd), '.loopx'); } function existsexactpath(path) { const parent = dirna

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/runtime-maintenance.mjsView on unpkg

skills/generate-api-docs/scripts/validate_api_docs.rbView file

•path = skills/generate-api-docs/scripts/validate_api_docs.rb kind = build_helper sizeBytes = 34383 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/generate-api-docs/scripts/validate_api_docs.rbView on unpkg

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/install-discovery.mjsView file

99Install-time AI-agent control hijack evidence: L99: kind: 'plugin', L100: sourceRelativePath: 'plugins/loopx/.codex-plugin/plugin.json', L101: }, ... L127: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L128: return resolve(env.LOOPX_AGENTS_ROOT || join(home, '.agents')); L129: } ... L136: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L137: return resolve(env.LOOPX_CLAUDE_SKILLS_ROOT || join(home, '.claude', 'skills')); L138: } ... L141: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L142: return resolve(env.LOOPX_CLAUDE_SETTINGS_PATH || join(home, '.claude', 'settings.json')); L143: } Payload evidence from [redacted]-features.md: L186: } L187: return ctx.JSON(200, resp) L188: }) ... L295: "kratos-mcp": { L296: "url": "http://loc

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

src/install-discovery.mjsView on unpkg · L99

•matchType = previous_version_dangerous_delta matchedPackage = @ai-content-space/loopx@0.4.3 matchedIdentity = npm:QGFpLWNvbnRlbnQtc3BhY2UvbG9vcHg:0.4.3 similarity = 0.385 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/install-discovery.mjsView on unpkg

114function jsonClone(value) { L115: return JSON.parse(JSON.stringify(value)); L116: } ... L121: L122: export function getProjectRoot(env = process.env) { L123: return resolve(env.LOOPX_PROJECT_ROOT || PROJECT_ROOT); ... L126: export function getAgentsRoot(env = process.env) { L127: const home = resolve(env.LOOPX_HOME || env.HOME || process.cwd()); L128: return resolve(env.LOOPX_AGENTS_ROOT || join(home, '.agents')); ... L278: path, L279: data: { L280: version: 3,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/install-discovery.mjsView on unpkg · L114

src/runtime-maintenance.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { mkdir, rename } from 'node:fs/promises'; import { existssync, readdirsync } from 'node:fs'; import { spawnsync } from 'node:child_process'; import { basename, dirname, join, resolve } from 'node:path'; import { gettemplatebaselinepath, inspectinstallstate, verifyinstallstate } from './install-discovery.mjs'; import { inspecttemplategovernance } from './template-governance.mjs'; import { inspectworkspacecontext } from './workspace-context.mjs'; export function resolveloopxroot(cwd) { return join(resolve(cwd), '.loopx'); } export function resolveuppercaseloopxroot(cwd) { return join(resolve(cwd), '.loopx'); } function existsexactpath(path) { const parent = dirna

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

src/runtime-maintenance.mjsView on unpkg

skills/generate-api-docs/scripts/validate_api_docs.rbView file

•path = skills/generate-api-docs/scripts/validate_api_docs.rb kind = build_helper sizeBytes = 34383 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/generate-api-docs/scripts/validate_api_docs.rbView on unpkg