Loading npm security reports…

@archangel70/cosmo@1.11.0: AI-agent control-surface risk | LPM Firewall

registry / @archangel70/cosmo / 1.11.0

@archangel70/cosmo@1.11.0

Local-first, multi-agent Astro website builder for Claude, Codex, Antigravity, and the command line.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation triggers automatic deployment of this package's AI-agent integrations. It modifies user-home agent control surfaces without a separate setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation, or setting COSMO_POSTINSTALL_FORCE=1 during installation.

Impact

The package gains persistent behavior-bearing integrations in Claude, Codex, and Antigravity user configuration.

Mechanism

Postinstall copies and replaces agent skills, workflows, plugins, and a launcher.

Policy narrative

Installing the package globally invokes postinstall. That script iterates over all supported agents with replacement enabled and validation disabled. The adapters copy package-controlled skill and workflow content into user-home Codex and Antigravity locations, while the Claude path copies a plugin and writes an executable launcher. This is automatic lifecycle mutation of multiple foreign AI-agent control surfaces, rather than an explicit user setup action.

AI rationale

The package has a concrete postinstall path that automatically persists integrations across three AI-agent environments on global installation. This meets the install-hook abuse policy even though no lifecycle network exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjspackages/cli/lib/agent-adapters.mjspackages/cli/lib/claude-plugin.mjs~/.agents/skills/cosmo~/.gemini/config/global_workflows/cosmo.md~/.claude/skills/cosmo

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/cli/lib/agent-adapters.mjsView file

17export function codexSkillTarget() { L18: return path.join(homeRoot('COSMO_CODEX_DIR', path.join(os.homedir(), '.agents')), 'skills', 'cosmo'); L19: } ... L46: } L47: fs.mkdirSync(path.dirname(target), { recursive: true }); L48: fs.cpSync(sharedSkillSource, target, { recursive: true }); L49: return skillStatus(target); ... L72: if (fs.existsSync(target) && replace && !antigravityStatus().installed) throw new Error(`Refusing to replace a workflow Cosmo does not own: ${target}`); L73: fs.mkdirSync(path.dirname(target), { recursive: true }); L74: fs.copyFileSync(source, target); L75: return antigravityStatus(); ... L95: const provider = normalizeAgent(agent);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

packages/cli/lib/agent-adapters.mjsView on unpkg · L17

packages/cli/lib/claude-plugin.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { fileurltopath } from 'node:url'; import { spawnsync } from 'node:child_process'; const moduledirectory = path.dirname(fileurltopath(import.meta.url)); const defaultsource = path.resolve(moduledirectory, '../../../plugins/claude-code/cosmo'); const sharedskill = path.resolve(moduledirectory, '../../../plugins/agent-skills/cosmo/skill.md'); const runtimecli = path.resolve(moduledirectory, '../bin/cosmo.mjs'); function shellquote(value) { return `'${string(value).replaceall("'", `'"'"'`)}'`; } export function claudeplugintarget() { const claudedirectory = process.env.cosmo_claude_dir

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

packages/cli/lib/claude-plugin.mjsView on unpkg

packages/cli/lib/process.mjsView file

•matchType = normalized_sha256 matchedPackage = @archangel70/cosmo@1.10.0 matchedPath = packages/cli/lib/process.mjs matchedIdentity = npm:QGFyY2hhbmdlbDcwL2Nvc21v:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/lib/process.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

packages/cli/lib/agent-adapters.mjsView file

17export function codexSkillTarget() { L18: return path.join(homeRoot('COSMO_CODEX_DIR', path.join(os.homedir(), '.agents')), 'skills', 'cosmo'); L19: } ... L46: } L47: fs.mkdirSync(path.dirname(target), { recursive: true }); L48: fs.cpSync(sharedSkillSource, target, { recursive: true }); L49: return skillStatus(target); ... L72: if (fs.existsSync(target) && replace && !antigravityStatus().installed) throw new Error(`Refusing to replace a workflow Cosmo does not own: ${target}`); L73: fs.mkdirSync(path.dirname(target), { recursive: true }); L74: fs.copyFileSync(source, target); L75: return antigravityStatus(); ... L95: const provider = normalizeAgent(agent);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

packages/cli/lib/agent-adapters.mjsView on unpkg · L17

packages/cli/lib/claude-plugin.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path'; import { fileurltopath } from 'node:url'; import { spawnsync } from 'node:child_process'; const moduledirectory = path.dirname(fileurltopath(import.meta.url)); const defaultsource = path.resolve(moduledirectory, '../../../plugins/claude-code/cosmo'); const sharedskill = path.resolve(moduledirectory, '../../../plugins/agent-skills/cosmo/skill.md'); const runtimecli = path.resolve(moduledirectory, '../bin/cosmo.mjs'); function shellquote(value) { return `'${string(value).replaceall("'", `'"'"'`)}'`; } export function claudeplugintarget() { const claudedirectory = process.env.cosmo_claude_dir

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

packages/cli/lib/claude-plugin.mjsView on unpkg

packages/cli/lib/process.mjsView file

•matchType = normalized_sha256 matchedPackage = @archangel70/cosmo@1.10.0 matchedPath = packages/cli/lib/process.mjs matchedIdentity = npm:QGFyY2hhbmdlbDcwL2Nvc21v:1.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/lib/process.mjsView on unpkg