Loading npm security reports…

@androidand/specsync@0.9.0: AI-agent policy block | LPM Firewall

registry / @androidand/specsync / 0.9.0

@androidand/specsync@0.9.0

Sync OpenSpec changes with work-tracker issues — standalone CLI

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Installing the package mutates multiple unrelated global AI-agent skill directories without user action. It also downloads a native executable that the CLI subsequently runs.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall; later invocation of `specsync`

Impact

Unconsented modification of broad AI-agent control surfaces and execution of a downloaded release binary.

Mechanism

global agent-skill injection plus remote native-binary bootstrap

Policy narrative

On npm installation, the lifecycle script reads the bundled skill and creates/writes it into five global AI-agent skill locations, including Codex and Claude, regardless of whether the user requested agent integration. The same hook downloads a platform binary from GitHub Releases, verifies it only against a checksum fetched from that same source, extracts it, and places it beside the CLI launcher. Later CLI use executes that downloaded binary.

Rationale

This is a concrete, unconsented `postinstall` mutation of foreign/broad AI-agent control surfaces, which meets the blocking policy. The remote binary bootstrap increases impact, even though the inspected JavaScript contains no credential harvesting or direct exfiltration.

Evidence

package.jsonscripts/postinstall.jsscripts/installer.jsbin/cli.jsskills/specsync/SKILL.mdbin/specsync~/.claude/skills/specsync/SKILL.md

Source & flagged code

7 flagged

package.jsonView file

Lines 1-40json

2 "name": "@androidand/specsync",

3 "version": "0.9.0",

4 "description": "Sync OpenSpec changes with work-tracker issues — standalone CLI",

5 "keywords": [

6 "openspec",

7 "github-issues",

8 "spec-driven",

9 "issue-tracker",

10 "sync",

11 "cli",

12 "planning"

13 ],

14 "author": "androidand",

15 "bugs": "https://github.com/androidand/specsync/issues",

16 "bin": {

17 "specsync": "bin/cli.js"

18 },

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "test": "node --test test/*.test.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "skills/"

27 ],

28 "os": [

29 "darwin",

30 "linux"

31 ],

32 "cpu": [

33 "x64",

34 "arm64"

35 ],

36 "engines": {

37 "node": ">=16"

38 },

39 "license": "MIT",

40 "repository": {

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Downloads the platform-matched specsync binary from GitHub Releases.

3// Asset names match .goreleaser.yaml: specsync_<os>_<arch>.tar.gz

4const fs = require("fs");

5const os = require("os"

bin/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.7.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5dc474ac932dff2d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @androidand/specsync@0.7.0 matchedPath = bin/cli.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.7.0 similarity = 1.000 shingleOverlap = 3 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.7.0 matchedPath = scripts/installer.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L21: // Install the specsync skill into every known global agent skill directory. L22: // Non-fatal: a missing ~/.claude or ~/.codex directory is normal. L23: function installSkill() { ... L27: const agentDirs = [ L28: path.join(os.homedir(), ".claude", "skills", "specsync"), L29: path.join(os.homedir(), ".codex", "skills", "specsync"), L30: path.join(os.homedir(), ".config", "opencode", "skills", "specsync"), ... L37: try { L38: fs.mkdirSync(dir, { recursive: true }); L39: fs.writeFileSync(path.join(dir, "SKILL.md"), skill); L40: console.log(`specsync: skill installed → ${dir}`); Payload evidence from skills/specsync/SKILL.md: L1: --- L2: name: specsync

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/postinstall.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @androidand/specsync@0.7.0 matchedPath = scripts/postinstall.js matchedIdentity = npm:QGFuZHJvaWRhbmQvc3BlY3N5bmM:0.7.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.jsView on unpkg

bin/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-40json

2 "name": "@androidand/specsync",

3 "version": "0.9.0",

4 "description": "Sync OpenSpec changes with work-tracker issues — standalone CLI",

5 "keywords": [

6 "openspec",

7 "github-issues",

8 "spec-driven",

9 "issue-tracker",

10 "sync",

11 "cli",

12 "planning"

13 ],

14 "author": "androidand",

15 "bugs": "https://github.com/androidand/specsync/issues",

16 "bin": {

17 "specsync": "bin/cli.js"

18 },

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "test": "node --test test/*.test.js"

22 },

23 "files": [

24 "bin/",

25 "scripts/",

26 "skills/"

27 ],

28 "os": [

29 "darwin",

30 "linux"

31 ],

32 "cpu": [

33 "x64",

34 "arm64"

35 ],

36 "engines": {

37 "node": ">=16"

38 },

39 "license": "MIT",

40 "repository": {

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2// Downloads the platform-matched specsync binary from GitHub Releases.

3// Asset names match .goreleaser.yaml: specsync_<os>_<arch>.tar.gz

4const fs = require("fs");

5const os = require("os"

bin/cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/cli.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/cli.jsView on unpkg

scripts/installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/installer.jsView on unpkg

@androidand/specsync@0.9.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code