Loading npm security reports…

@androidand/specsync@0.13.2: AI-agent control-surface risk | LPM Firewall

registry / @androidand/specsync / 0.13.2

@androidand/specsync@0.13.2

Sync OpenSpec changes with work-tracker issues — standalone CLI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies several unrelated global AI-agent skill directories. It also downloads a native executable that the installed command later runs.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs the postinstall hook; invoking specsync runs the downloaded binary.

Impact

The package can alter instructions available to multiple AI-agent tools without an explicit setup command, then execute remotely supplied native code.

Mechanism

Postinstall writes global agent skills and retrieves a remote executable.

Policy narrative

On npm installation, the postinstall script creates and overwrites a SpecSync skill in five global AI-agent directories. This is an unconsented mutation of broad, foreign agent control surfaces. The same lifecycle hook downloads a native archive and a server-provided checksum from GitHub Releases, extracts the binary into the package, and the CLI executes it later. No secret theft was found in the inspected JavaScript, but the automatic control-surface changes and remote native payload are sufficient for blocking.

Rationale

This package uses an automatic lifecycle hook to write instructions into several global AI-agent control surfaces without user action. That behavior meets the install-control-surface block policy, and it is coupled to remote native-binary delivery.

Evidence

package.jsonscripts/postinstall.jsscripts/installer.jsbin/cli.jsskills/specsync/SKILL.md~/.claude/skills/specsync/SKILL.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

21// Install the specsync skill into every known global agent skill directory. L22: // Non-fatal: a missing ~/.claude or ~/.codex directory is normal. L23: function installSkill() { ... L27: const agentDirs = [ L28: path.join(os.homedir(), ".claude", "skills", "specsync"), L29: path.join(os.homedir(), ".codex", "skills", "specsync"), L30: path.join(os.homedir(), ".config", "opencode", "skills", "specsync"), L31: path.join(os.homedir(), ".copilot", "skills", "specsync"), L32: path.join(os.homedir(), ".agents", "skills", "specsync"), L33: ]; ... L37: try { L38: fs.mkdirSync(dir, { recursive: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L21

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.12.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.12.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5dc474ac932dff2d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @androidand/specsync@0.12.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.12.0 matchedPath = scripts/installer.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "@androidand/specsync",

3 "version": "0.13.2",

4 "description": "Sync OpenSpec changes with work-tracker issues — standalone CLI",

5 "keywords": [

6 "openspec",

7 "github-issues",

8 "spec-driven",

9 "issue-tracker",

10 "sync",

11 "cli",

12 "planning"

13 ],

14 "author": "androidand",

15 "bugs": "https://github.com/androidand/specsync/issues",

16 "bin": {

17 "specsync": "bin/cli.js"

18 },

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "test": "node --test test/*.test.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "skills/"

27 ],

28 "os": [

29 "darwin",

30 "linux"

31 ],

32 "cpu": [

33 "x64",

34 "arm64"

35 ],

36 "engines": {

37 "node": ">=16"

38 },

39 "license": "MIT",

40 "repository": {

scripts/postinstall.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2// Downloads the platform-matched specsync binary from GitHub Releases.

3// Asset names match .goreleaser.yaml: specsync_<os>_<arch>.tar.gz

4const fs = require("fs");

5const os = require("os"

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.12.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5dc474ac932dff2d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @androidand/specsync@0.12.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.12.0 matchedPath = scripts/installer.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg