Loading npm security reports…

@astraworks/cli@0.2.9: AI-agent control-surface risk | LPM Firewall

registry / @astraworks/cli / 0.2.9

@astraworks/cli@0.2.9

Local AI work system engine and multi-project dashboard

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package mutates all projects previously registered by AstraWorks. Those upgrades overwrite managed AI-agent skill directories for the agents recorded for each project.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm postinstall during package installation.

Impact

It changes foreign project AI-agent control files without an install-time user command or consent.

Mechanism

Forced lifecycle upgrade of registered projects and their agent instruction surfaces.

Policy narrative

On installation, the postinstall script first calls a forced upgrade for every project in the package's registry. The runtime detects several AI-agent platforms and writes or overwrites their managed skill directories inside those project roots. This occurs before the documented automatic-engine-start opt-out is evaluated. The hook then starts or restarts a detached local service. The automatic, cross-project mutation of AI-agent control surfaces is concrete and unconsented.

Rationale

This package performs unconsented postinstall mutation of broad, foreign AI-agent control surfaces across registered projects. That meets the blocking boundary even though no data exfiltration was confirmed.

Evidence

package.jsonscripts/postinstall.mjsdist/install/runtime.mjs.astraworks/install.json.astraworks/reports/updatesAGENTS.mdCLAUDE.md.agents/skills.claude/skills.cursor/skills

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install/runtime.mjsView file

1var Mn=Object.defineProperty;var E=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Wn=(t,e)=>{for(var r in e)Mn(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function dt(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=B.join(t,o.name),s=B.join(e,o.n... L3: ... L11: ${r.stderr||""}`;return r.code===0&&/(?:-p,\s*--print|--print\b)/.test(n)}async function na(t,e=[["--version"],["-v"]]){for(let r of e){let n=await P(t,r,{timeoutMs:3e3,maxChars:1e... L12: `),o=null;for(let a of n){let s=/^(\w[\w-]*)\s*:\s*(.*)$/.exec(a);if(s&&!a.startsWith(" ")&&!a.startsWith(" ")){o=s[1];let c=s[2].trim().replace(/^["']|["']$/g,"");c&&(e[o]=c)}else... L13: `);return`${Rr} ... L66: `);awai

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/install/runtime.mjsView on unpkg · L1

1var Mn=Object.defineProperty;var E=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Wn=(t,e)=>{for(var r in e)Mn(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function dt(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=B.join(t,o.name),s=B.join(e,o.n... L3:

High

Child Process

Package source references child process execution.

dist/install/runtime.mjsView on unpkg · L1

1var Mn=Object.defineProperty;var E=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Wn=(t,e)=>{for(var r in e)Mn(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function dt(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=B.join(t,o.name),s=B.join(e,o.n... L3: ... L8: `).map(e=>/^\s*[-*+]\s+(.+)$/.exec(e)?.[1]).filter(Boolean).map(at)}function Ce(t){return String(t||"").split(` L9: `).map(e=>/^\s*\d+[.)]\s+(.+)$/.exec(e)?.[1]).filter(Boolean).map(at)}function Vr(t){return/扫描|读取|收集|写入|写回|更新|同步|归档|执行命令|生成/.test(t)?"script":/(?:由|交给|等待)(?:用户|人工).*(?:审批|拍板|确认|决策|... L10: `)})}async function Ho(t,e=Me[t],r={}){if(!e)return null;let n=r.platform||process.platform,o={...process.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/install/runtime.mjsView on unpkg · L1

1var Mn=Object.defineProperty;var E=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Wn=(t,e)=>{for(var r in e)Mn(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function dt(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=B.join(t,o.name),s=B.join(e,o.n... L3: ... L5: L6: ${r.slice(-n)}`}async function P(t,e,r={}){let{cwd:n=process.cwd(),input:o="",timeoutMs:a=3e5,maxChars:s=8e4,env:c={},signal:i}=r;return new Promise(l=>{let u=Eo(t,e),p=Ro(u.comman... L7: ${t}`,T=Ft(e.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(R)?"closed":"open");return{purpose:De(i,260),outcome:De(g,260),loopType:T==="closed"?"closed":"open",owner:Ft(... L8: `).map(e=>/^\s*[-*+]\s+(.+)$/.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/install/runtime.mjsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.postinstall -> scripts/postinstall.mjs -> dist/install/runtime.mjs L1: var Mn=Object.defineProperty;var E=(t,e,r)=>()=>{if(r)throw r[0];try{return t&&(e=t(t=0)),e}catch(n){throw r=[n],n}};var Wn=(t,e)=>{for(var r in e)Mn(t,r,{get:e[r],enumerable:!0})}... L2: `)}async function m(t){await I.mkdir(t,{recursive:!0})}async function dt(t,e,r={}){let n=await I.readdir(t,{withFileTypes:!0});for(let o of n){let a=B.join(t,o.name),s=B.join(e,o.n... L3: ... L5: L6: ${r.slice(-n)}`}async function P(t,e,r={}){let{cwd:n=process.cwd(),input:o="",timeoutMs:a=3e5,maxChars:s=8e4,env:c={},signal:i}=r;return new Promise(l=>{let u=Eo(t,e),p=Ro(u.comman... L7: ${t}`,T=Ft(e.loopType)||(/closed loop|目标完成后.*结束|完成后自动结束|达成.*停止/i.test(R)?"closed":"open");

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/install/runtime.mjsView on unpkg · L1

dist/cli/index.mjsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.mjs: var Rm=Object.defineProperty;var w=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var G=(e,t)=>{for(var n in t)Rm(e,n,{get:t[n],enumerable:!0})};... `)}async function $(e){await $e.mkdir(e,{recursive:!0})}async function kc(e,t){await $e.copyFile(e,t)}async function dn(e,t,n={}){let r=await $e.readdir(e,{withFileTypes:!0});for(l... `,r=await Kc.open(e,"a");try{await r.writeFile(n)}finally{await r.close()}}async function re(e,t){let n=t.map(r=>JSON.stringify(r)).join(` `:""))}async function af(e,t){let n=await L(e);return t?n.filter(t):n}async function sf(e,t,n){let o=(await L(e)).map(a=>t(a)?n(a):a);ret

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/index.mjsView on unpkg

dist/dashboard/project-worker.mjsView file

1var Ip=Object.defineProperty;var k=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var ae=(e,t)=>{for(var n in t)Ip(e,n,{get:t[n],enumerable:!0})}... L2: `)}async function b(e){await he.mkdir(e,{recursive:!0})}async function tc(e,t){await he.copyFile(e,t)}async function en(e,t,n={}){let r=await he.readdir(e,{withFileTypes:!0});for(l... ... L5: `);await R(e,n+(n?` L6: `:""))}async function Lp(e,t){let n=await I(e);return t?n.filter(t):n}async function Dp(e,t,n){let o=(await I(e)).map(a=>t(a)?n(a):a);return await ee(e,o),o}var ce=k(()=>{O()});fun... L7: ... L9: L10: ${n.slice(-r)}`}async function E(e,t,n={}){let{cwd:r=process.cwd(),input:o="",timeoutMs:a=3e5,maxChars:s=8e4,env:i={},signal:c}=n;return new Promise(l=>{let d=gm(e,t),m=fm(d.comman... L11:

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/dashboard/project-worker.mjsView on unpkg · L1

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView file

•path = dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.py kind = build_helper sizeBytes = 1050 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView on unpkg

dist/agents/auto-capture.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @astraworks/cli@0.2.2 matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.2 similarity = 0.583 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/auto-capture.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 6-44json

6 "workspaces": [

7 "packages/*"

8 ],

9 "bin": {

10 "astraworks": "bin/astraworks.js"

11 },

12 "files": [

13 "bin",

14 "dist",

15 "scripts/postinstall.mjs",

16 "templates",

17 "schemas",

18 "LICENSE",

19 "README.md"

20 ],

21 "scripts": {

22 "clean": "node scripts/clean.mjs",

23 "build:agent-kit": "npm run build --workspace @astraworks/agent-kit",

24 "build": "npm run build:agent-kit && node scripts/build.mjs",

25 "build:release": "npm run build:agent-kit && node scripts/build-release.mjs",

26 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "test:agent-kit": "npm test --workspace @astraworks/agent-kit",

28 "test": "npm run build && npm run test:agent-kit && bash test/run-all.sh",

29 "test:package-e2e": "npm run build && node test/package-e2e/run.mjs",

30 "pack:check": "npm run build && npm pack --dry-run",

31 "prepack": "npm run build:release"

32 },

33 "publishConfig": {

34 "access": "public"

35 },

36 "license": "SEE LICENSE IN LICENSE",

37 "engines": {

38 "node": ">=20"

39 },

40 "devDependencies": {

41 "esbuild": "^0.28.2"

42 }

43}

44

dist/install/runtime.mjsView file

Lines 1-21javascript

1var Mn=Object.defineProperty;var E=(t,e,r)=>()=>{if(r)throw r[0];try{return t

dist/cli/index.mjsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/cli/index.mjs: var Rm=Object.defineProperty;var w=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(r){throw n=[r],r}};var G=(e,t)=>{for(var n in t)Rm(e,n,{get:t[n],enumerable:!0})};... `)}async function $(e){await $e.mkdir(e,{recursive:!0})}async function kc(e,t){await $e.copyFile(e,t)}async function dn(e,t,n={}){let r=await $e.readdir(e,{withFileTypes:!0});for(l... `,r=await Kc.open(e,"a");try{await r.writeFile(n)}finally{await r.close()}}async function re(e,t){let n=t.map(r=>JSON.stringify(r)).join(` `:""))}async function af(e,t){let n=await L(e);return t?n.filter(t):n}async function sf(e,t,n){let o=(await L(e)).map(a=>t(a)?n(a):a);ret

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/cli/index.mjsView on unpkg

dist/dashboard/project-worker.mjsView file

Lines 1-21javascript

1var Ip=Object.defineProperty;var k=(e,t,n)=>()=>{if(n)throw n[0];try{return e

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView file

•path = dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.py kind = build_helper sizeBytes = 1050 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/agent-baseline/skills/personal-dashboard/scripts/validate_dashboard.pyView on unpkg

dist/agents/auto-capture.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @astraworks/cli@0.2.2 matchedIdentity = npm:QGFzdHJhd29ya3MvY2xp:0.2.2 similarity = 0.583 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/auto-capture.mjsView on unpkg