@astraworks/cli@0.2.20: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@astraworks/cli@0.2.20: AI-agent control-surface risk | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/runtime.mjsView file

1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L2: var Dg=Object.create;var ra=Object.defineProperty;var Rg=Object.getOwnPropertyDescriptor;var qg=Object.getOwnPropertyNames;var Mg=Object.getPrototypeOf,Fg=Object.prototype.hasOwnPr... L3: `)}async function w(e){await ye.mkdir(e,{recursive:!0})}async function Q(e,t,n={}){let r=await ye.readdir(e,{withFileTypes:!0});for(let i of r){let s=ct.join(e,i.name),a=ct.join(t,... L4: `);return`${nu} ... L24: - \u539F\u59CB\u6750\u6599\u8FDB\u5165 \`.astraworks/llm-wiki/raw/\`\uFF0C\u53EF\u590D\u7528\u77E5\u8BC6\u8FDB\u5165 \`.astraworks/llm-wiki/wiki/\`\uFF0C\u8FD0\u884C\u8BC1\u636E\u8... L25: - \u77E5\u8BC6\u5E93\u4EFB\u52A1\u5FC5\u987B\u8BFB\u53D6\u5F53\u524D\u9879\u76EE\u7684 \

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install/runtime.mjsView on unpkg · L1

284- Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286:

High

Child Process

Package source references child process execution.

dist/install/runtime.mjsView on unpkg · L284

284- Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286: ... L288: L289: ${n.slice(-r)}`}async function G(e,t,n={}){let{cwd:r=process.cwd(),input:i="",timeoutMs:s=3e5,maxChars:a=8e4,env:o={},signal:c}=n;return new Promise(l=>{let u=Nk(e,t),f=xk(u.comman... L290: ${e}`,y=qr(t.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(v)?"closed":"open");return{purpose:vc(c,260),outcome:vc(g,260),loopType:y==="closed"?"closed":"open",owner:qr(... L291: `).map(t=>/^\s*[-*+]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function bc(e){return String(e||"").split(` L292: `).map(t=>/^\s*\d+[.)]\s+(.+)$/.exec(t)?.[1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/install/runtime.mjsView on unpkg · L284

284- Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286: ... L288: L289: ${n.slice(-r)}`}async function G(e,t,n={}){let{cwd:r=process.cwd(),input:i="",timeoutMs:s=3e5,maxChars:a=8e4,env:o={},signal:c}=n;return new Promise(l=>{let u=Nk(e,t),f=xk(u.comman... L290: ${e}`,y=qr(t.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(v)?"closed":"open");return{purpose:vc(c,260),outcome:vc(g,260),loopType:y==="closed"?"closed":"open",owner:qr(... L291: `).map(t=>/^\s*[-*+]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function bc(e){return String(e||"").split(` L292: `).map(t=>/^\s*\d+[.)]\s+(.+)$/.exec(t)?.[1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/install/runtime.mjsView on unpkg · L284

1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L2: var Dg=Object.create;var ra=Object.defineProperty;var Rg=Object.getOwnPropertyDescriptor;var qg=Object.getOwnPropertyNames;var Mg=Object.getPrototypeOf,Fg=Object.prototype.hasOwnPr... L3: `)}async function w(e){await ye.mkdir(e,{recursive:!0})}async function Q(e,t,n={}){let r=await ye.readdir(e,{withFileTypes:!0});for(let i of r){let s=ct.join(e,i.name),a=ct.join(t,... L4: `);return`${nu} ... L284: - Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286: ... L288: L289: ${n.slice(-r)}`}async f

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/install/runtime.mjsView on unpkg · L1

dist/embed/index.mjsView file

227Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/embed/index.mjs L227: L228: `);return{agent:n,sourceRoot:e,buildRoot:t,sourceDigest:f,instructions:r,workflow:s,inputSchema:i,outputSchema:a,bindingsRaw:o,bindings:l,policies:c,compiledBody:d}}async function ... L229: `).filter(Boolean).map(n=>{try{return JSON.parse(n)}catch{return{_malformed:n.slice(0,500)}}})}catch{return[]}}async function Ca(e,t){let n=JSON.stringify(t)+` ... L231: `)} L232: `)}async function Ia(e){for(let t=0;t<40;t+=1){if(await Nn(Wu))try{return await e()}finally{await es(Wu)}await new Promise(n=>setTimeout(n,25))}throw new Error("project registry is... L233: ... L235: L236: ${n.slice(-r)}`}async function se(e,t,n={}){let{cwd:r=process.cwd(),input:s="",timeoutMs:i=3e5,maxChars:a=8e4,env:o

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/embed/index.mjsView on unpkg · L227

templates/project/loops/self-growth/check.shView file

•path = templates/project/loops/self-growth/check.sh kind = build_helper sizeBytes = 4315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/project/loops/self-growth/check.shView on unpkg

dist/agents/auto-capture.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/auto-capture.mjs#virtual:string-array:round1View on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 11-51json

11 },

12 "exports": {

13 "./embed": "./dist/embed/index.mjs"

14 },

15 "files": [

16 "bin",

17 "dist",

18 "scripts/postinstall.mjs",

19 "templates",

20 "schemas",

21 "docs/agenthub-repository-contract.md",

22 "LICENSE",

23 "README.md"

24 ],

25 "scripts": {

26 "clean": "node scripts/clean.mjs",

27 "build:agent-kit": "npm run build --workspace @astraworks/agent-kit",

28 "build:dsh-plugin": "npm run build --workspace @astraworks/dsh-astraworks",

29 "build": "npm run build:agent-kit && node scripts/build.mjs && npm run build:dsh-plugin",

30 "build:release": "npm run build:agent-kit && node scripts/build-release.mjs && npm run build:dsh-plugin",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test:agent-kit": "npm test --workspace @astraworks/agent-kit",

33 "test:dsh-plugin": "npm test --workspace @astraworks/dsh-astraworks",

34 "test:unit": "node --test test/*.test.mjs",

35 "test": "npm run build && npm run test:unit && npm run test:agent-kit && npm run test:dsh-plugin && bash test/run-all.sh",

36 "test:package-e2e": "npm run build && node test/package-e2e/run.mjs",

37 "pack:check": "npm run build && npm pack --dry-run",

38 "prepack": "npm run build:release"

39 },

40 "publishConfig": {

41 "access": "public"

42 },

43 "license": "SEE LICENSE IN LICENSE",

44 "engines": {

45 "node": ">=20"

46 },

47 "dependencies": {

48 "@astraworks/agent-kit": "0.1.2"

49 },

50 "devDependencies": {

51 "esbuild": "^0.28.2",

dist/install/runtime.mjsView file

Lines 1-21javascript

1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);

2var Dg=Object.create;var ra=

dist/embed/index.mjsView file

Lines 207-247javascript

207

208\u76EE\u6807\u6267\u884C\u5F15\u64CE\u5FC5\u987B\u9075\u5FAA\u4EE5\u4E0B\u9636\u6BB5\u3001\u5206\u652F\u548C\u7EC8\u6B62\u6761\u4EF6\u3002\u8BE5 YAML \u4F5C\u4E3A\u8BED\u4E49\u5951\u7EA6\u4FDD\u7559\u3002

209

210\`\`\`yaml

211${s.trim()}

212\`\`\``,`## \u8F93\u5165\u5951\u7EA6

templates/project/loops/self-growth/check.shView file

•path = templates/project/loops/self-growth/check.sh kind = build_helper sizeBytes = 4315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/project/loops/self-growth/check.shView on unpkg

dist/agents/auto-capture.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/auto-capture.mjs#virtual:string-array:round1View on unpkg

Lines 264-304javascript

264`,this.pos),this.lineEndPos=t),t===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[t-1]==="\r"&&(t-=1),this.buffer.substring(this.pos,t))}hasChars(t){return this.pos+t<=this.buffer.length}setNext(t){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=t,null}peek(t){return this.buffer.substr(this.pos,t)}*parseNext(t){switch(t){case"stream":return yield*this.parseStream();case"line-start":return yield*this.parseLineStart();case"block-start":return yield*this.parseBlockStart();case"doc":return yield*this.parseDocument();case"flow":return yi ...

265`,this.pos);if(i!==-1){for(;i!==-1;){let s=this.continueScalar(i+1);if(s===-1)break;i=r.indexOf(`

266`,s)}i!==-1&&(n=i-(r[i-1]==="\r"?2:1))}if(n===-1){if(!this.atEnd)return this.

267`:t=s,n=0;break;case"\r":{let a=this.buffer[s+1];if(!a&&!this.atEnd)return this.setNext("block-scalar"

268`)break}default:break e}if(!r&&!this.atEnd)return this.setNext("block-scalar");if(n>=this.indentNext){this.blockScalarIndent===-1?

269`,s)}while(t!==-1);if(t===-1){if(!this.atEnd)return this.setNext("block-scalar");t=this.buffer.length}}let i=t+1

270`;)r=this.buffer[++i];t=i-1}else if(!this.blockScalarKeep)do{let s=t-1,a=this.buffer[s];a==="\r"&&

271`&&s>=this.pos&&s+1+n>o)t=s;else break}while(!0);return yield Pr.SCALAR,yield*this.pushToIndex(t

272`?(r+=1,i=`

273`,s=this.buffer[r+1]):n=r),s==="#"||t&&hs.has(s))break;if(i===`

274`){let a=this.continueScalar(r+1);if(a===-1)break;r=Math.max(r,a-2)}}else{if(t&&hs.has(i))break;n

275`?yield*this.pushCount(1):t==="\r"&&this.charAt(1)===`

276`?yield*this.pushCount(2):0}*pushSpaces(t){let n=this.pos-1,r;do r=this.buffer[++n];while(r===" "||t&&r===" ");let i=n-this.pos;return i>0&&(yield this.buffer.substr(this.pos,i),this.pos=n),i}*pushUntil(t){let n=this.pos,r=this.buffer[n];for(;!t(r);)r=this.buffer[++n];return yield*this.pushToIndex(n,!1)}};rp.Lexer=cc});var dc=A(ip=>{"use strict";var uc=class{constructor(){this.lineStarts=[],this.addNewLine=t=>this.lineStarts.push(t),this.linePos=t=>{let n=0,r=this.lineStarts.length;for(;n<r;){let s=n+r>>1;this.lineStarts[s]<t?n=s+1:r=s}if(this.lineStarts[n]===t)return{line:n+1,col:1};if(n===0) ...

277`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(`

278`,n)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(t){let n=t.items[t.items.length-1];

279`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(`

280`,n)+1}return{type:t,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(t){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start ...

281

282## ${r.version}

283

284- Initial AstraWorks Agent definition.

285`),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks"

286

High

Child Process

Package source references child process execution.

dist/install/runtime.mjsView on unpkg · L284

287... [truncated ${n.length-t} chars] ...

288

289${n.slice(-r)}`}async function G(e,t,n={}){let{cwd:r=process.cwd(),input:i="",timeoutMs:s=3e5,maxChars:a=8e4,env:o={},signal:c}=n;return new Promise(l=>{let u=Nk(e,t),f=xk(u.command,u.args,Oe({cwd:r,stdio:"pipe",env:{...process.env,...o}})),d="",p="",h=new Sp("utf8"),m=new Sp("utf8"),g=!1,v=null,y=null,S=()=>{f.kill("SIGTERM"),y=setTimeout(()=>f.kill("SIGKILL"),5e3)};c?.aborted?S():c?.addEventListener("abort",S,{once:!0}),s>0&&(v=setTimeout(()=>{g=!0,f.kill("SIGTERM"),setTimeout(()=>f.kill("SIGKILL"),5e3)},s)),f.stdout.on("data",_=>{d+=h.write(_),d.length>a*2&&(d=Ve(d,a*2))}),f.stderr.on("data ...

290${e}`,y=qr(t.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(v)?"closed":"open");return{purpose:vc(c,260),outcome:vc(g,260),loopType:y==="closed"?"closed":"open"

291`).map(t=>/^\s*[-*+]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function bc(e){return String

292`).map(t=>/^\s*\d+[.)]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function Ep(e){return

293`)})}async function Xk(e,t=_c[e],n={}){if(!t)return null;let r=n.platform||process.platform,i={...process.env,...n.env||{}},s=n.pathModule||(r==="win32"?Fr.win32:Fr),a=s.delimiter,o=s.join(Ac,"node_modules",".bin"),c={...i,PATH:[o,i.PATH].filter(Boolean).join(a)},l=process.env[`ASTRAWORKS_ACP_${String(e||"").toUpperCase()}_BIN`],u=l&&await nA(l)?l:await Pn(tA(e,t.command,{platform:r,env:i,pathModule:s}),{platform:r,env:c,pathModule:s,pathDelimiter:a});return u?{command:u,args:Pp(t.args)}:null}function Pp(e){return Array.isArray(e)?e.map(String):[]}async function Zk(e,t){let n=await O(ks,{});n[ ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/install/runtime.mjsView on unpkg · L284

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/install/runtime.mjsView on unpkg · L284

294${n.stderr||""}`;return n.code===0&&/(?:-p,\s*--print|--print\b)/.test(r)}async function aA(e,t=[["--version"],["-v"]]){for(let n of t){let

295`),i=null;for(let s of r){let a=/^(\w[\w-]*)\s*:\s*(.*)$/.exec(s);if(a&&!s.startsWith(" ")&&!s.startsWith(" ")){i=a[1];let o=a[2].trim().replace(/^["']|["']$/g,"");o&&(t[i]=o)}else if(i&&/^\s+(\w[\w-]*)\s*:\s*(.*)$/.test(s)){let o=/^\s+(\w[\w-]*)\s*:\s*(.*)$/.exec(s);if(o){(!t[i]||typeof t[i]=="string")&&(t[i]={});let c=o[2].trim().replace(/^["']|["']$/g,"");c&&(t[i][o[1]]=c)}}}return t}function cA(e){if(e===!0||e==="true")return!0;if(e===!1||e==="false")return!1}async function lA(e,t={}){let n=B(t.projectRoot),r=vs(n),i=await P(r.contentReadme(e));if(!i)throw new Error(`Loop

296required:

297 - data

298 - loops

299 - reports

300 - experience

301 - llm-wiki

302`),await At(T.join(r,"policies","governance.yaml"),`schema_version: 1

303engine_findings_create_todos: false

304auto_repair: true

Long lines were clipped for display.