Loading npm security reports…

@androidand/specsync@0.11.2: AI-agent control-surface risk | LPM Firewall

registry / @androidand/specsync / 0.11.2

@androidand/specsync@0.11.2

Sync OpenSpec changes with work-tracker issues — standalone CLI

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently installs a package-provided SKILL.md into multiple unrelated global AI-agent control surfaces. It also downloads and installs a remotely hosted executable.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation

Impact

Unconsented agent behavior injection across installed assistants; remote release content is executed later by the CLI.

Mechanism

postinstall writes global agent skills and stages a remote binary

Policy narrative

Installing the package automatically invokes postinstall. That hook creates missing global skill directories and writes its skill into five separate AI-agent products without a user command or consent, then fetches and installs a release binary. This is a broad foreign agent control-surface mutation at install time.

Rationale

The automatic multi-vendor global AI-agent skill installation is concrete unconsented control-surface mutation, meeting the block policy. The remote binary download increases impact but is secondary to the confirmed lifecycle behavior.

Evidence

package.jsonscripts/postinstall.jsscripts/installer.jsskills/specsync/SKILL.mdbin/cli.jsbin/specsync~/.claude/skills/specsync/SKILL.md~/.codex/skills/specsync/SKILL.md~/.config/opencode/skills/specsync/SKILL.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

21// Install the specsync skill into every known global agent skill directory. L22: // Non-fatal: a missing ~/.claude or ~/.codex directory is normal. L23: function installSkill() { ... L27: const agentDirs = [ L28: path.join(os.homedir(), ".claude", "skills", "specsync"), L29: path.join(os.homedir(), ".codex", "skills", "specsync"), L30: path.join(os.homedir(), ".config", "opencode", "skills", "specsync"), L31: path.join(os.homedir(), ".copilot", "skills", "specsync"), L32: path.join(os.homedir(), ".agents", "skills", "specsync"), L33: ]; ... L37: try { L38: fs.mkdirSync(dir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.10.1 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.10.1 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5dc474ac932dff2d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @androidand/specsync@0.10.1 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.10.1 matchedPath = scripts/installer.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "@androidand/specsync",

3 "version": "0.11.2",

4 "description": "Sync OpenSpec changes with work-tracker issues — standalone CLI",

5 "keywords": [

6 "openspec",

7 "github-issues",

8 "spec-driven",

9 "issue-tracker",

10 "sync",

11 "cli",

12 "planning"

13 ],

14 "author": "androidand",

15 "bugs": "https://github.com/androidand/specsync/issues",

16 "bin": {

17 "specsync": "bin/cli.js"

18 },

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "test": "node --test test/*.test.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "skills/"

27 ],

28 "os": [

29 "darwin",

30 "linux"

31 ],

32 "cpu": [

33 "x64",

34 "arm64"

35 ],

36 "engines": {

37 "node": ">=16"

38 },

39 "license": "MIT",

40 "repository": {

scripts/postinstall.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2// Downloads the platform-matched specsync binary from GitHub Releases.

3// Asset names match .goreleaser.yaml: specsync_<os>_<arch>.tar.gz

4const fs = require("fs");

5const os = require("os"

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.10.1 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5dc474ac932dff2d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @androidand/specsync@0.10.1 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.10.1 matchedPath = scripts/installer.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.10.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg