Loading npm security reports…

@aionlabsai/aion: AI-agent control-surface risk | LPM Firewall

registry / @aionlabsai/aion / 1.0.5

@aionlabsai/aion@1.0.5

Multi-agent AI engineering runtime — audit, fix, graph, analyze

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically mutates the consumer project and creates generated instructions for AI agents. No network endpoint is needed for this control-surface change.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

An unconsented install can place mandatory tool-use instructions into a project artifact that may influence later AI-agent behavior.

Mechanism

The lifecycle hook runs init; init generates wiki content; wiki writes agent-directed guidance into the project.

Policy narrative

Installing the package runs its CLI automatically. That command generates a project document containing mandatory instructions telling AI agents to use Aion before raw file reads or searches, and writes it into the consumer project. Although direct MCP registration is disabled for this lifecycle path, the automatic creation of agent-directed control content remains an unconsented mutation of an AI-agent control surface.

AI rationale

The package uses postinstall to inject agent-directed guidance into consumer projects without an explicit user command. This is concrete install-hook abuse affecting AI-agent behavior.

Evidence

package.jsondist/cli/commands/init.jsdist/cli/commands/wiki.js.ai-runtime/PROJECT.md

Decision evidence

public snapshot

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const pkg=require('./package.json');if(pkg.name==='@aionlabsai/aion')process.exit(0);require('child_process').execSync('node ./dist/index.js init --sk[redacted] --no-mc...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const pkg=require('./package.json');if(pkg.name==='@aionlabsai/aion')process.exit(0);require('child_process').execSync('node ./dist/index.js init --sk[redacted] --no-mc...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/assist/remote-executor.jsView file

1import { spawnSync } from 'child_process'; L2: const DANGEROUS_RE = /(?:^|\s)(rm|mkfs|dd|shutdown|reboot|chmod\s+777|chown\s+-R)\b|[;&|`$><]/;

High

Child Process

Package source references child process execution.

dist/infra/assist/remote-executor.jsView on unpkg · L1

dist/infra/package-guard.jsView file

17cwd, L18: shell: true, L19: encoding: 'utf8',

High

Shell

Package source references shell execution.

dist/infra/package-guard.jsView on unpkg · L17

dist/infra/project-store.jsView file

25try { L26: const parsed = JSON.parse(readFileSync(path, 'utf8')); L27: if (parsed.schemaVersion !== PROJECT_SCHEMA_VERSION)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/infra/project-store.jsView on unpkg · L25

dist/infra/embeddings.jsView file

41for (let i = 0; i < token.length; i++) { L42: hash ^= token.charCodeAt(i); L43: hash = Math.imul(hash, 16777619); ... L71: export function embeddingProvider() { L72: if (process.env.VOYAGE_API_KEY) L73: return 'voyage-code-3'; ... L100: const batch = texts.slice(i, i + 128); L101: const res = await fetch('https://api.voyageai.com/v1/embeddings', { L102: method: 'POST', L103: headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.VOYAGE_API_KEY}` }, L104: body: JSON.stringify({ input: batch, model: 'voyage-code-3' }), L105: });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/infra/embeddings.jsView on unpkg · L41

41Trigger-reachable chain: scripts.start -> dist/index.js -> dist/cli/commands/eval.js -> dist/infra/embeddings.js L41: for (let i = 0; i < token.length; i++) { L42: hash ^= token.charCodeAt(i); L43: hash = Math.imul(hash, 16777619); ... L71: export function embeddingProvider() { L72: if (process.env.VOYAGE_API_KEY) L73: return 'voyage-code-3'; ... L100: const batch = texts.slice(i, i + 128); L101: const res = await fetch('https://api.voyageai.com/v1/embeddings', { L102: method: 'POST', L103: headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.VOYAGE_API_KEY}` }, L104: body: JSON.stringify({ input: batch, model: 'voyage-code-3' }), L105: });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/infra/embeddings.jsView on unpkg · L41

41Trigger-reachable credential exfiltration chain: scripts.start -> dist/index.js -> dist/cli/commands/eval.js -> dist/infra/embeddings.js L41: for (let i = 0; i < token.length; i++) { L42: hash ^= token.charCodeAt(i); L43: hash = Math.imul(hash, 16777619); ... L71: export function embeddingProvider() { L72: if (process.env.VOYAGE_API_KEY) L73: return 'voyage-code-3'; ... L100: const batch = texts.slice(i, i + 128); L101: const res = await fetch('https://api.voyageai.com/v1/embeddings', { L102: method: 'POST', L103: headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.VOYAGE_API_KEY}` }, L104: body: JSON.stringify({ input: batch, model: 'voyage-code-3' }), L105: });

dist/agents/base-agent.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: import { writeFileSync, mkdirSync } from 'fs'; L2: import { join } from 'path'; ... L36: writeClaudeMd(worktreePath) { L37: const claudeDir = join(worktreePath, '.claude'); L38: mkdirSync(claudeDir, { recursive: true }); L39: writeFileSync(join(claudeDir, 'CLAUDE.md'), this.config.systemPrompt, 'utf8'); L40: } Write operation from dist/infra/knowledge.js: L1: import { join } from 'path'; L2: import { mkdirSync, readdirSync, readFileSync, writeFileSync, existsSync } from 'fs'; L3: import { EmbeddingStore } from './embeddings.js'; ... L33: for (const cat of CATEGORIES) { L34: mkdirSync(join(this.root, cat), { recursive: true }); L35: } ... L72: const filepath = join(this.root, category, filename); L73: writeFileSync(f

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/agents/base-agent.jsView on unpkg · L1

dist/cli/commands/mcp.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ync } from 'fs'; import { homedir } from 'os'; import { join } from 'path'; import { installclient, doctorcheck, defaultbinpath, defaultserverargs, } from '../../mcp/install.js'; import { createrotatinglog } from '../../mcp/log-file.js'; import { observabilitysummary, recententries } from '../../mcp/observability.js'; function defaultmcpcwd() { return process.cwd(); } function readclaudeconfig() { const path = join(homedir(), '.claude', 'mcp.json'); if (!existssync(path)) return null; try { const parsed = json.parse(readfilesync(path, 'utf8')); return { servers: parsed.mcpservers ?? {} }; } catch { return null; } } function starttailing(logp

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/mcp.jsView on unpkg

dist/cli/commands/setup.jsView file

2Cross-file remote execution chain: dist/cli/commands/setup.js spawns dist/cli/commands/graph.js; helper contains network access plus dynamic code execution. L2: import { join } from 'path'; L3: import { spawnSync } from 'child_process'; L4: import chalk from 'chalk'; ... L21: function runSelfCommand(cwd, args) { L22: return runSelfCommandWithEnv(cwd, args, process.env); L23: } ... L30: return false; L31: process.stdout.write(chalk.yellow('\nRemote embeddings failed. Retrying with local fallback (hash-384d, no API key required)...\n')); L32: const fallbackEnv = { ... L139: .action(async (options) => { L140: const cwd = process.cwd(); L141: if (options.reset) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/commands/setup.jsView on unpkg · L2

dist/infra/assist/generators/artifacts.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/infra/assist/generators/artifacts.js#virtual:normalized:round1View on unpkg

dist/prompts/scanner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aionlabsai/aion@1.0.2-alpha matchedIdentity = npm:QGFpb25sYWJzYWkvYWlvbg:1.0.2-alpha similarity = 0.608 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/prompts/scanner.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 3-43json

3 "version": "1.0.5",

4 "description": "Multi-agent AI engineering runtime — audit, fix, graph, analyze",

5 "type": "module",

6 "bin": {

7 "aion": "dist/index.js",

8 "ai-runtime": "dist/index.js"

9 },

10 "scripts": {

11 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

12 "build": "npm run clean && tsc",

13 "test": "npm run build && node --import tsx --test \"src/**/*.test.ts\"",

14 "test:unit": "npm run test",

15 "test:scale": "npm run build && node --import tsx --test \"src/core/pipelines/audit-pipeline.test.ts\"",

16 "smoke:manus": "npm run dev -- --cwd /home/bruno/Documents/GitHub/Manus_Private audit . -n 1",

17 "dev": "tsx src/index.ts",

18 "start": "node dist/index.js",

19 "release-check": "npm run build && node dist/index.js release-check --skip-build",

20 "prepublishOnly": "npm run build",

21 "install-global": "npm run build && npm link",

22 "uninstall-global": "npm unlink -g @aionlabsai/aion",

23 "postinstall": "node -e \"const pkg=require('./package.json');if(pkg.name==='@aionlabsai/aion')process.exit(0);require('child_process').execSync('node ./dist/index.js init --skip-embeddings --no-mcp || true',{stdio:'inherit'})\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L23

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

24 },

25 "files": [

26 "dist/**/*",

27 "!dist/**/*.map",

28 "!dist/test-utils/**",

29 "README.md"

30 ],

31 "engines": {

32 "node": ">=18.0.0"

33 },

34 "keywords": [

35 "ai",

36 "audit",

37 "multi-agent",

38 "code-analysis",

39 "security",

40 "cli"

41 ],

42 "author": "Bruno Inácio <contact@walo.us>",

43 "license": "MIT",

dist/infra/assist/remote-executor.jsView file

Lines 1-21javascript

1import { spawnSync } from 'child_process';

2const DANGEROUS_RE = /(?:^|\s)(rm|mkfs|dd|shutdown|reboot|chmod\s+777|chown\s+

dist/infra/package-guard.jsView file

Lines 1-37javascript

1import { spawnSync } from 'child_process';

2import { mkdtempSync, mkdirSync, readdirSync, rmSync, statSync } from 'fs';

3import { join } from 'path';

4import { tmpdir } from 'os';

dist/infra/project-store.jsView file

Lines 5-45javascript

5export const PROJECT_SCHEMA_VERSION = 1;

6export const VECTORS_FILE = 'project.vectors.bin';

7export const PROJECT_FILE

dist/infra/embeddings.jsView file

Lines 21-61javascript

21 }

22}

23async function callXenova(texts) {

24 const pipe = await getXenovaPipeline();

25 if

dist/agents/base-agent.jsView file

Lines 1-21javascript

1import { writeFileSync, mkdirSync } from 'fs';

2import { join } from 'path';

3import { createRuntimePolicy, limitChars, limitLines } from '../core/runtime-policy.js';

4import { createProvider } from '../providers/cli-provider.js'

dist/cli/commands/mcp.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: ync } from 'fs'; import { homedir } from 'os'; import { join } from 'path'; import { installclient, doctorcheck, defaultbinpath, defaultserverargs, } from '../../mcp/install.js'; import { createrotatinglog } from '../../mcp/log-file.js'; import { observabilitysummary, recententries } from '../../mcp/observability.js'; function defaultmcpcwd() { return process.cwd(); } function readclaudeconfig() { const path = join(homedir(), '.claude', 'mcp.json'); if (!existssync(path)) return null; try { const parsed = json.parse(readfilesync(path, 'utf8')); return { servers: parsed.mcpservers ?? {} }; } catch { return null; } } function starttailing(logp

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli/commands/mcp.jsView on unpkg

dist/cli/commands/setup.jsView file

Lines 1-22javascript

1import { existsSync, mkdirSync, writeFileSync } from 'fs';

2import { join } from 'path';

3import { spawnSync } from 'child_process';

4import chalk from 'chalk';

dist/infra/assist/generators/artifacts.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/infra/assist/generators/artifacts.js#virtual:normalized:round1View on unpkg

dist/prompts/scanner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aionlabsai/aion@1.0.2-alpha matchedIdentity = npm:QGFpb25sYWJzYWkvYWlvbg:1.0.2-alpha similarity = 0.608 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/prompts/scanner.jsView on unpkg