Loading npm security reports…

@astraworks/cli@0.2.21: AI-agent control-surface risk | LPM Firewall

registry / @astraworks/cli / 0.2.21

@astraworks/cli@0.2.21

Local AI work system engine and multi-project dashboard

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package mutates every project previously registered by AstraWorks without an install-time user command. It overwrites agent skills and instruction files, starts a background service, and can create persistent launchd supervision.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation.

Impact

Foreign registered projects receive AI-agent control files and a persistent local service without current-install consent.

Mechanism

Forced registered-project upgrade plus automatic daemon startup.

Policy narrative

Installing the package invokes postinstall. That script enumerates registered projects and forces their upgrade, which copies agent skills and rewrites instruction files. It then starts or restarts the AstraWorks engine; the runtime contains launchd persistence configured to run at load and remain alive. The behavior changes broad previously registered project and AI-agent control surfaces without an explicit command for this installation.

AI rationale

This is concrete unconsented postinstall mutation of foreign registered projects' AI-agent control surfaces, coupled with automatic background-service persistence. It meets the blocking install-control-surface policy.

Evidence

package.jsonscripts/postinstall.mjsdist/install/runtime.mjs.astraworks/registry/projects.jsonlAGENTS.md.agents/skills/*.claude/skills/*.cursor/skills/*

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/runtime.mjsView file

1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L2: var Dg=Object.create;var ra=Object.defineProperty;var Rg=Object.getOwnPropertyDescriptor;var qg=Object.getOwnPropertyNames;var Mg=Object.getPrototypeOf,Fg=Object.prototype.hasOwnPr... L3: `)}async function w(e){await ye.mkdir(e,{recursive:!0})}async function Q(e,t,n={}){let r=await ye.readdir(e,{withFileTypes:!0});for(let i of r){let s=ct.join(e,i.name),a=ct.join(t,... L4: `);return`${nu} ... L24: - \u539F\u59CB\u6750\u6599\u8FDB\u5165 \`.astraworks/llm-wiki/raw/\`\uFF0C\u53EF\u590D\u7528\u77E5\u8BC6\u8FDB\u5165 \`.astraworks/llm-wiki/wiki/\`\uFF0C\u8FD0\u884C\u8BC1\u636E\u8... L25: - \u77E5\u8BC6\u5E93\u4EFB\u52A1\u5FC5\u987B\u8BFB\u53D6\u5F53\u524D\u9879\u76EE\u7684 \

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install/runtime.mjsView on unpkg · L1

284- Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286: ... L288: L289: ${n.slice(-r)}`}async function G(e,t,n={}){let{cwd:r=process.cwd(),input:i="",timeoutMs:s=3e5,maxChars:a=8e4,env:o={},signal:c}=n;return new Promise(l=>{let u=Nk(e,t),f=xk(u.comman... L290: ${e}`,y=qr(t.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(v)?"closed":"open");return{purpose:vc(c,260),outcome:vc(g,260),loopType:y==="closed"?"closed":"open",owner:qr(... L291: `).map(t=>/^\s*[-*+]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function bc(e){return String(e||"").split(` L292: `).map(t=>/^\s*\d+[.)]\s+(.+)$/.exec(t)?.[1

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/install/runtime.mjsView on unpkg · L284

284- Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286: ... L288: L289: ${n.slice(-r)}`}async function G(e,t,n={}){let{cwd:r=process.cwd(),input:i="",timeoutMs:s=3e5,maxChars:a=8e4,env:o={},signal:c}=n;return new Promise(l=>{let u=Nk(e,t),f=xk(u.comman... L290: ${e}`,y=qr(t.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(v)?"closed":"open");return{purpose:vc(c,260),outcome:vc(g,260),loopType:y==="closed"?"closed":"open",owner:qr(... L291: `).map(t=>/^\s*[-*+]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function bc(e){return String(e||"").split(` L292: `).map(t=>/^\s*\d+[.)]\s+(.+)$/.exec(t)?.[1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/install/runtime.mjsView on unpkg · L284

1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L2: var Dg=Object.create;var ra=Object.defineProperty;var Rg=Object.getOwnPropertyDescriptor;var qg=Object.getOwnPropertyNames;var Mg=Object.getPrototypeOf,Fg=Object.prototype.hasOwnPr... L3: `)}async function w(e){await ye.mkdir(e,{recursive:!0})}async function Q(e,t,n={}){let r=await ye.readdir(e,{withFileTypes:!0});for(let i of r){let s=ct.join(e,i.name),a=ct.join(t,... L4: `);return`${nu} ... L284: - Initial AstraWorks Agent definition. L285: `),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks","knowledge","loops","mcp","orchestrations","schem... L286: ... L288: L289: ${n.slice(-r)}`}async f

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/install/runtime.mjsView on unpkg · L1

dist/embed/index.mjsView file

227Trigger-reachable command-output exfiltration chain: manifest.exports -> dist/embed/index.mjs L227: L228: `);return{agent:n,sourceRoot:e,buildRoot:t,sourceDigest:f,instructions:r,workflow:s,inputSchema:i,outputSchema:a,bindingsRaw:o,bindings:l,policies:c,compiledBody:d}}async function ... L229: `).filter(Boolean).map(n=>{try{return JSON.parse(n)}catch{return{_malformed:n.slice(0,500)}}})}catch{return[]}}async function Ca(e,t){let n=JSON.stringify(t)+` ... L231: `)} L232: `)}async function Ia(e){for(let t=0;t<40;t+=1){if(await Nn(Wu))try{return await e()}finally{await es(Wu)}await new Promise(n=>setTimeout(n,25))}throw new Error("project registry is... L233: ... L235: L236: ${n.slice(-r)}`}async function se(e,t,n={}){let{cwd:r=process.cwd(),input:s="",timeoutMs:i=3e5,maxChars:a=8e4,env:o

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/embed/index.mjsView on unpkg · L227

•matchType = normalized_sha256 matchedPackage = @astraworks/cli@0.2.20 matchedPath = dist/embed/index.mjs matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/embed/index.mjsView on unpkg

templates/project/loops/self-growth/check.shView file

•path = templates/project/loops/self-growth/check.sh kind = build_helper sizeBytes = 4315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/project/loops/self-growth/check.shView on unpkg

dist/agents/auto-capture.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/auto-capture.mjs#virtual:string-array:round1View on unpkg

dist/dashboard/project-worker.mjsView file

•matchType = normalized_sha256 matchedPackage = @astraworks/cli@0.2.20 matchedPath = dist/dashboard/project-worker.mjs matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/project-worker.mjsView on unpkg

dist/service/daemon-entry.mjsView file

•matchType = normalized_sha256 matchedPackage = @astraworks/cli@0.2.20 matchedPath = dist/service/daemon-entry.mjs matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service/daemon-entry.mjsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 11-51json

11 },

12 "exports": {

13 "./embed": "./dist/embed/index.mjs"

14 },

15 "files": [

16 "bin",

17 "dist",

18 "scripts/postinstall.mjs",

19 "templates",

20 "schemas",

21 "docs/agenthub-repository-contract.md",

22 "LICENSE",

23 "README.md"

24 ],

25 "scripts": {

26 "clean": "node scripts/clean.mjs",

27 "build:agent-kit": "npm run build --workspace @astraworks/agent-kit",

28 "build:dsh-plugin": "npm run build --workspace @astraworks/dsh-astraworks",

29 "build": "npm run build:agent-kit && node scripts/build.mjs && npm run build:dsh-plugin",

30 "build:release": "npm run build:agent-kit && node scripts/build-release.mjs && npm run build:dsh-plugin",

31 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test:agent-kit": "npm test --workspace @astraworks/agent-kit",

33 "test:dsh-plugin": "npm test --workspace @astraworks/dsh-astraworks",

34 "test:unit": "node --test test/*.test.mjs",

35 "test": "npm run build && npm run test:unit && npm run test:agent-kit && npm run test:dsh-plugin && bash test/run-all.sh",

36 "test:package-e2e": "npm run build && node test/package-e2e/run.mjs",

37 "pack:check": "npm run build && npm pack --dry-run",

38 "prepack": "npm run build:release"

39 },

40 "publishConfig": {

41 "access": "public"

42 },

43 "license": "SEE LICENSE IN LICENSE",

44 "engines": {

45 "node": ">=20"

46 },

47 "dependencies": {

48 "@astraworks/agent-kit": "0.1.2"

49 },

50 "devDependencies": {

51 "esbuild": "^0.28.2",

dist/install/runtime.mjsView file

Lines 1-21javascript

1import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);

2var Dg=Object.create;var ra=

dist/embed/index.mjsView file

Lines 207-247javascript

207

208\u76EE\u6807\u6267\u884C\u5F15\u64CE\u5FC5\u987B\u9075\u5FAA\u4EE5\u4E0B\u9636\u6BB5\u3001\u5206\u652F\u548C\u7EC8\u6B62\u6761\u4EF6\u3002\u8BE5 YAML \u4F5C\u4E3A\u8BED\u4E49\u5951\u7EA6\u4FDD\u7559\u3002

209

210\`\`\`yaml

211${s.trim()}

212\`\`\``,`## \u8F93\u5165\u5951\u7EA6

templates/project/loops/self-growth/check.shView file

•path = templates/project/loops/self-growth/check.sh kind = build_helper sizeBytes = 4315 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/project/loops/self-growth/check.shView on unpkg

dist/agents/auto-capture.mjs#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/auto-capture.mjs#virtual:string-array:round1View on unpkg

dist/dashboard/project-worker.mjsView file

•matchType = normalized_sha256 matchedPackage = @astraworks/cli@0.2.20 matchedPath = dist/dashboard/project-worker.mjs matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/project-worker.mjsView on unpkg

dist/service/daemon-entry.mjsView file

•matchType = normalized_sha256 matchedPackage = @astraworks/cli@0.2.20 matchedPath = dist/service/daemon-entry.mjs matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/service/daemon-entry.mjsView on unpkg

Lines 264-304javascript

264`,this.pos),this.lineEndPos=t),t===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[t-1]==="\r"&&(t-=1),this.buffer.substring(this.pos,t))}hasChars(t){return this.pos+t<=this.buffer.length}setNext(t){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=t,null}peek(t){return this.buffer.substr(this.pos,t)}*parseNext(t){switch(t){case"stream":return yield*this.parseStream();case"line-start":return yield*this.parseLineStart();case"block-start":return yield*this.parseBlockStart();case"doc":return yield*this.parseDocument();case"flow":return yi ...

265`,this.pos);if(i!==-1){for(;i!==-1;){let s=this.continueScalar(i+1);if(s===-1)break;i=r.indexOf(`

266`,s)}i!==-1&&(n=i-(r[i-1]==="\r"?2:1))}if(n===-1){if(!this.atEnd)return this.

267`:t=s,n=0;break;case"\r":{let a=this.buffer[s+1];if(!a&&!this.atEnd)return this.setNext("block-scalar"

268`)break}default:break e}if(!r&&!this.atEnd)return this.setNext("block-scalar");if(n>=this.indentNext){this.blockScalarIndent===-1?

269`,s)}while(t!==-1);if(t===-1){if(!this.atEnd)return this.setNext("block-scalar");t=this.buffer.length}}let i=t+1

270`;)r=this.buffer[++i];t=i-1}else if(!this.blockScalarKeep)do{let s=t-1,a=this.buffer[s];a==="\r"&&

271`&&s>=this.pos&&s+1+n>o)t=s;else break}while(!0);return yield Pr.SCALAR,yield*this.pushToIndex(t

272`?(r+=1,i=`

273`,s=this.buffer[r+1]):n=r),s==="#"||t&&hs.has(s))break;if(i===`

274`){let a=this.continueScalar(r+1);if(a===-1)break;r=Math.max(r,a-2)}}else{if(t&&hs.has(i))break;n

275`?yield*this.pushCount(1):t==="\r"&&this.charAt(1)===`

276`?yield*this.pushCount(2):0}*pushSpaces(t){let n=this.pos-1,r;do r=this.buffer[++n];while(r===" "||t&&r===" ");let i=n-this.pos;return i>0&&(yield this.buffer.substr(this.pos,i),this.pos=n),i}*pushUntil(t){let n=this.pos,r=this.buffer[n];for(;!t(r);)r=this.buffer[++n];return yield*this.pushToIndex(n,!1)}};rp.Lexer=cc});var dc=A(ip=>{"use strict";var uc=class{constructor(){this.lineStarts=[],this.addNewLine=t=>this.lineStarts.push(t),this.linePos=t=>{let n=0,r=this.lineStarts.length;for(;n<r;){let s=n+r>>1;this.lineStarts[s]<t?n=s+1:r=s}if(this.lineStarts[n]===t)return{line:n+1,col:1};if(n===0) ...

277`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(`

278`,n)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(t){let n=t.items[t.items.length-1];

279`)+1;for(;n!==0;)this.onNewLine(this.offset+n),n=this.source.indexOf(`

280`,n)+1}return{type:t,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(t){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start ...

281

282## ${r.version}

283

284- Initial AstraWorks Agent definition.

285`),r}var it,hc,Lk,gp,Ik,Rr=k(()=>{it=Hn($n(),1);Y();pe();F();hc=["agents","docs","environments","evals","harness-profiles","hooks"

286

287... [truncated ${n.length-t} chars] ...

288

289${n.slice(-r)}`}async function G(e,t,n={}){let{cwd:r=process.cwd(),input:i="",timeoutMs:s=3e5,maxChars:a=8e4,env:o={},signal:c}=n;return new Promise(l=>{let u=Nk(e,t),f=xk(u.command,u.args,Oe({cwd:r,stdio:"pipe",env:{...process.env,...o}})),d="",p="",h=new Sp("utf8"),m=new Sp("utf8"),g=!1,v=null,y=null,S=()=>{f.kill("SIGTERM"),y=setTimeout(()=>f.kill("SIGKILL"),5e3)};c?.aborted?S():c?.addEventListener("abort",S,{once:!0}),s>0&&(v=setTimeout(()=>{g=!0,f.kill("SIGTERM"),setTimeout(()=>f.kill("SIGKILL"),5e3)},s)),f.stdout.on("data",_=>{d+=h.write(_),d.length>a*2&&(d=Ve(d,a*2))}),f.stderr.on("data ...

290${e}`,y=qr(t.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(v)?"closed":"open");return{purpose:vc(c,260),outcome:vc(g,260),loopType:y==="closed"?"closed":"open"

291`).map(t=>/^\s*[-*+]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function bc(e){return String

292`).map(t=>/^\s*\d+[.)]\s+(.+)$/.exec(t)?.[1]).filter(Boolean).map(zt)}function Ep(e){return

293`)})}async function Xk(e,t=_c[e],n={}){if(!t)return null;let r=n.platform||process.platform,i={...process.env,...n.env||{}},s=n.pathModule||(r==="win32"?Fr.win32:Fr),a=s.delimiter,o=s.join(Ac,"node_modules",".bin"),c={...i,PATH:[o,i.PATH].filter(Boolean).join(a)},l=process.env[`ASTRAWORKS_ACP_${String(e||"").toUpperCase()}_BIN`],u=l&&await nA(l)?l:await Pn(tA(e,t.command,{platform:r,env:i,pathModule:s}),{platform:r,env:c,pathModule:s,pathDelimiter:a});return u?{command:u,args:Pp(t.args)}:null}function Pp(e){return Array.isArray(e)?e.map(String):[]}async function Zk(e,t){let n=await O(ks,{});n[ ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/install/runtime.mjsView on unpkg · L284

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/install/runtime.mjsView on unpkg · L284

294${n.stderr||""}`;return n.code===0&&/(?:-p,\s*--print|--print\b)/.test(r)}async function aA(e,t=[["--version"],["-v"]]){for(let n of t){let

295`),i=null;for(let s of r){let a=/^(\w[\w-]*)\s*:\s*(.*)$/.exec(s);if(a&&!s.startsWith(" ")&&!s.startsWith(" ")){i=a[1];let o=a[2].trim().replace(/^["']|["']$/g,"");o&&(t[i]=o)}else if(i&&/^\s+(\w[\w-]*)\s*:\s*(.*)$/.test(s)){let o=/^\s+(\w[\w-]*)\s*:\s*(.*)$/.exec(s);if(o){(!t[i]||typeof t[i]=="string")&&(t[i]={});let c=o[2].trim().replace(/^["']|["']$/g,"");c&&(t[i][o[1]]=c)}}}return t}function cA(e){if(e===!0||e==="true")return!0;if(e===!1||e==="false")return!1}async function lA(e,t={}){let n=B(t.projectRoot),r=vs(n),i=await P(r.contentReadme(e));if(!i)throw new Error(`Loop

296required:

297 - data

298 - loops

299 - reports

300 - experience

301 - llm-wiki

302`),await At(T.join(r,"policies","governance.yaml"),`schema_version: 1

303engine_findings_create_todos: false

304auto_repair: true

Long lines were clipped for display.