Loading npm security reports…

@astraworks/cli@0.2.16: AI-agent control-surface risk | LPM Firewall

registry / @astraworks/cli / 0.2.16

@astraworks/cli@0.2.16

Local AI work system engine and multi-project dashboard

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package modifies every project in its global registry, including AI-agent skills and instruction files, then starts a detached service. This occurs without an explicit command for each affected project.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

Previously registered projects can receive replaced agent skills and modified agent instructions automatically.

Mechanism

Forced cross-project agent-control-surface rewrite and detached service launch.

Policy narrative

On installation, the lifecycle hook calls a forced upgrade for every project previously registered by the package. The upgrade replaces managed skill directories and updates instruction files for several AI-agent ecosystems, so projects outside the installing project are changed automatically. It then starts or restarts a detached engine service by default. This is an unconsented broad AI-agent control-surface mutation through postinstall.

AI rationale

The package has a concrete automatic lifecycle chain that forcefully rewrites AI-agent control surfaces across registered projects and launches a service. This meets the publish-block policy for unconsented postinstall mutation of a foreign or broad agent control surface.

Evidence

scripts/postinstall.mjsdist/install/runtime.mjs.agents/skillsAGENTS.md.claude/skillsCLAUDE.md.cursor/skills.codebuddy/skillsCODEBUDDY.md

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/runtime.mjsView file

1var Un=Object.defineProperty;var R=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Bn=(t,e)=>{for(var r in e)Un(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function ht(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=J.join(t,o.name),i=J.join(e,o.n... L3: ... L11: ${r.stderr||""}`;return r.code===0&&/(?:-p,\s*--print|--print\b)/.test(n)}async function sa(t,e=[["--version"],["-v"]]){for(let r of e){let n=await P(t,r,{timeoutMs:3e3,maxChars:1e... L12: `),o=null;for(let a of n){let i=/^(\w[\w-]*)\s*:\s*(.*)$/.exec(a);if(i&&!a.startsWith(" ")&&!a.startsWith(" ")){o=i[1];let c=i[2].trim().replace(/^["']|["']$/g,"");c&&(e[o]=c)}else... L13: `);return`${$r} ... L66: `);awai

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install/runtime.mjsView on unpkg · L1

1var Un=Object.defineProperty;var R=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Bn=(t,e)=>{for(var r in e)Un(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function ht(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=J.join(t,o.name),i=J.join(e,o.n... L3: ... L8: `).map(e=>/^\s*[-*+]\s+(.+)$/.exec(e)?.[1]).filter(Boolean).map(ct)}function Fe(t){return String(t||"").split(` L9: `).map(e=>/^\s*\d+[.)]\s+(.+)$/.exec(e)?.[1]).filter(Boolean).map(ct)}function tn(t){return/扫描|读取|收集|写入|写回|更新|同步|归档|执行命令|生成/.test(t)?"script":/(?:由|交给|等待)(?:用户|人工).*(?:审批|拍板|确认|决策|... L10: `)})}async function Zo(t,e=Ue[t],r={}){if(!e)return null;let n=r.platform||process.platform,o={...process.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/install/runtime.mjsView on unpkg · L1

1var Un=Object.defineProperty;var R=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Bn=(t,e)=>{for(var r in e)Un(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function ht(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=J.join(t,o.name),i=J.join(e,o.n... L3: ... L5: L6: ${r.slice(-n)}`}async function P(t,e,r={}){let{cwd:n=process.cwd(),input:o="",timeoutMs:a=3e5,maxChars:i=8e4,env:c={},signal:s}=r;return new Promise(l=>{let u=Lo(t,e),p=Do(u.comman... L7: ${t}`,T=qt(e.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(E)?"closed":"open");return{purpose:Me(s,260),outcome:Me(g,260),loopType:T==="closed"?"closed":"open",owner:qt(... L8: `).map(e=>/^\s*[-*+]\s+(.+)$/.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/install/runtime.mjsView on unpkg · L1

1var Un=Object.defineProperty;var R=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Bn=(t,e)=>{for(var r in e)Un(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function ht(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=J.join(t,o.name),i=J.join(e,o.n... L3: ... L5: L6: ${r.slice(-n)}`}async function P(t,e,r={}){let{cwd:n=process.cwd(),input:o="",timeoutMs:a=3e5,maxChars:i=8e4,env:c={},signal:s}=r;return new Promise(l=>{let u=Lo(t,e),p=Do(u.comman... L7: ${t}`,T=qt(e.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(E)?"closed":"open");return{purpose:Me(s,260),outcome:Me(g,260),loopType:T==="closed"?"closed":"open",owner:qt(... L8: `).map(e=>/^\s*[-*+]\s+(.+)$/.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/install/runtime.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.postinstall -> scripts/postinstall.mjs -> dist/install/runtime.mjs L1: var Un=Object.defineProperty;var R=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Bn=(t,e)=>{for(var r in e)Un(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function ht(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=J.join(t,o.name),i=J.join(e,o.n... L3: ... L5: L6: ${r.slice(-n)}`}async function P(t,e,r={}){let{cwd:n=process.cwd(),input:o="",timeoutMs:a=3e5,maxChars:i=8e4,env:c={},signal:s}=r;return new Promise(l=>{let u=Lo(t,e),p=Do(u.comman... L7: ${t}`,T=qt(e.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(E)?"closed":"open");

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/install/runtime.mjsView on unpkg · L1

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView file

•path = dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.py kind = build_helper sizeBytes = 1050 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView on unpkg

dist/agents/auto-capture.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/auto-capture.mjs#virtual:string-array:round1View on unpkg

dist/agents/auto-capture.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @astraworks/cli@0.2.2 matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.2 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/auto-capture.mjsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 6-44json

6 "workspaces": [

7 "packages/*"

8 ],

9 "bin": {

10 "astraworks": "bin/astraworks.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "scripts/postinstall.mjs",

16 "templates",

17 "schemas",

18 "LICENSE",

19 "README.md"

20 ],

21 "scripts": {

22 "clean": "node scripts/clean.mjs",

23 "build:agent-kit": "npm run build --workspace @astraworks/agent-kit",

24 "build": "npm run build:agent-kit && node scripts/build.mjs",

25 "build:release": "npm run build:agent-kit && node scripts/build-release.mjs",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "test:agent-kit": "npm test --workspace @astraworks/agent-kit",

28 "test": "npm run build && npm run test:agent-kit && bash test/run-all.sh",

29 "test:package-e2e": "npm run build && node test/package-e2e/run.mjs",

30 "pack:check": "npm run build && npm pack --dry-run",

31 "prepack": "npm run build:release"

32 },

33 "publishConfig": {

34 "access": "public"

35 },

36 "license": "SEE LICENSE IN LICENSE",

37 "engines": {

38 "node": ">=20"

39 },

40 "devDependencies": {

41 "esbuild": "^0.28.2"

42 }

43}

44

dist/install/runtime.mjsView file

Lines 1-21javascript

1var Un=Object.defineProperty;var R=(t,e,r)=>()=>{if(r)throw r[0];try{return t

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView file

•path = dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.py kind = build_helper sizeBytes = 1050 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView on unpkg

dist/agents/auto-capture.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/auto-capture.mjs#virtual:string-array:round1View on unpkg

dist/agents/auto-capture.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @astraworks/cli@0.2.2 matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.2 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/auto-capture.mjsView on unpkg