Loading npm security reports…

@androidand/specsync@0.13.1: AI-agent control-surface risk | LPM Firewall

registry / @androidand/specsync / 0.13.1

@androidand/specsync@0.13.1

Sync OpenSpec changes with work-tracker issues — standalone CLI

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package automatically writes a skill into several unrelated global AI-agent control surfaces. It also retrieves a platform binary from GitHub Releases for later execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs postinstall.

Impact

The package can alter the behavior of multiple installed AI-agent tools without an explicit setup command.

Mechanism

Automatic global AI-agent skill injection and remote binary installation.

Policy narrative

During npm installation, postinstall copies package-controlled instructions into global skill directories for Claude, Codex, OpenCode, Copilot, and generic agents, creating missing directories as needed. The same automatic hook downloads and installs a release binary. The CLI subsequently executes that binary. This is unconsented install-time mutation of broad foreign AI-agent control surfaces.

AI rationale

The automatic postinstall hook broadly modifies global AI-agent configurations, which meets the install-control-surface blocking policy. The accompanying remote binary download increases the unreviewable runtime surface.

Evidence

package.jsonscripts/postinstall.jsscripts/installer.jsbin/cli.jsskills/specsync/SKILL.mdbin/specsync~/.claude/skills/specsync/SKILL.md~/.codex/skills/specsync/SKILL.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

21// Install the specsync skill into every known global agent skill directory. L22: // Non-fatal: a missing ~/.claude or ~/.codex directory is normal. L23: function installSkill() { ... L27: const agentDirs = [ L28: path.join(os.homedir(), ".claude", "skills", "specsync"), L29: path.join(os.homedir(), ".codex", "skills", "specsync"), L30: path.join(os.homedir(), ".config", "opencode", "skills", "specsync"), L31: path.join(os.homedir(), ".copilot", "skills", "specsync"), L32: path.join(os.homedir(), ".agents", "skills", "specsync"), L33: ]; ... L37: try { L38: fs.mkdirSync(dir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.14.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.14.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0106c1bae732a49e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @androidand/specsync@0.14.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.14.0 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.14.0 matchedPath = scripts/installer.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg