registry / @ax-llm/ax / 24.0.20

@ax-llm/ax@24.0.20

The best library to work with LLMs

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On npm install, a postinstall script copies this package's Ax skill markdown into the consumer project's .claude/skills folders unless CI or AX_SKIP_SKILL_INSTALL is set. The files are first-party library usage guides, not a hidden remote payload.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing @ax-llm/ax with npm, yarn, or pnpm outside CI, without AX_SKIP_SKILL_INSTALL.

Impact

Claude Code in that project can load Ax library skills without the user running setup-claude.

Mechanism

Unattended Claude Code skill file install

AI rationale

This is a real TypeScript LLM library whose postinstall quietly installs first-party Claude Code skills into the consumer project. That is unconsented agent-extension setup, not a hidden malware chain, so it is a warning rather than a publish block.

Evidence

package.jsonscripts/postinstall.mjsskills/ax-llm.md.claude/skills/ax-llm/SKILL.md.claude/skills/ax

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

npm postinstall runs scripts/postinstall.mjs automatically on install.
That script copies packaged ax-* skill markdown into the consumer project's .claude/skills directories without a setup command.
The only skips are CI environment variables or AX_SKIP_SKILL_INSTALL; errors are swallowed so install still succeeds.
It also deletes leftover markdown under .claude/skills/ax except SKILL.md.

Evidence against

The dropped files are first-party Ax library codegen skills (names like ax-llm and ax-agent), not Claude settings, hooks, or CLAUDE.md.
index.js, index.cjs, and index.global.js are a minified TypeScript LLM SDK (signatures, providers, agents), not an install-time payload.
Postinstall does not harvest credentials, open a network connection, or depend on another release of this package.
An explicit ax CLI setup-claude and remove-claude path exists; scanner malware labels are prior-version fingerprints, not a hidden second payload.

Behavioral surface

Source

DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 3.71 MB of source, external domains: ai.google.dev, api-docs.deepseek.com, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepinfra.com, api.deepseek.com, api.featherless.ai, api.fireworks.ai, api.friendli.ai, api.groq.com, api.hyperbolic.xyz, api.meta.ai, api.mistral.ai, api.novita.ai, api.openai.com, api.orcarouter.ai, api.reka.ai, api.sambanova.ai, api.scaleway.ai, api.siliconflow.com, api.studio.nebius.com, api.together.xyz, api.tokenfactory.nebius.com, api.typesafe.ai, api.x.ai, cloud.google.com, console.groq.com, dev.meta.ai, developers.cloudflare.com, docs.anthropic.com, docs.aws.amazon.com, docs.baseten.co, docs.cloud.google.com, docs.cohere.com, docs.databricks.com, docs.deepinfra.com, docs.fireworks.ai, docs.hyperbolic.xyz, docs.mistral.ai, docs.nscale.com, docs.nvidia.com, docs.ollama.com, docs.ovhcloud.com, docs.reka.ai, docs.runpod.io, docs.sambanova.ai, docs.siliconflow.com, docs.together.ai, docs.typesafe.ai

Source & flagged code

13 flagged

package.jsonView file

Lines 34-56json

34 "author": "Vikram <https://twitter.com/dosco>",

35 "main": "./index.cjs",

36 "module": "./index.js",

37 "exports": {

38 ".": {

39 "types": "./index.d.ts",

40 "import": "./index.js",

41 "require": "./index.cjs"

42 },

43 "./*": {

44 "types": "./*.d.ts",

45 "import": "./*.js",

46 "require": "./*.cjs"

47 },

48 "./index.global.js": "./index.global.js"

49 },

50 "bin": {

51 "ax": "./cli/index.mjs"

52 },

53 "scripts": {

54 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 }

56}

index.jsView file

762- Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var ak={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L762

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

scripts/postinstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for @ax-llm/ax

5 *

6 * Auto-installs/upgrades the Claude Code skill on package install.

7 *

8 * Features:

9 * - Skips in CI environments (CI, CONTINUOUS_INTEGRATION env vars)

10 * - Skips if AX_SKIP_SKILL_INSTALL=1

11 * - Silent failure (never breaks package installation)

index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ax-llm/ax@24.0.18 matchedIdentity = npm:QGF4LWxsbS9heA:24.0.18 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.cjsView on unpkg

762Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L762: - Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var Zk={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Gc=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L762

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

index.global.jsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.global.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg

index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.d.ts matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L762

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L764

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L764

scripts/postinstall.mjsView file

18existsSync, L19: mkdirSync, L20: readFileSync, ... L22: rmSync, L23: writeFileSync, L24: } from 'node:fs'; ... L190: const projectRoot = findProjectRoot(); L191: const skillsBaseDir = join(projectRoot, '.claude', 'skills'); L192: ... L205: L206: // Clean up legacy flat file structure (.claude/skills/ax/*.md except SKILL.md) L207: const legacyDir = join(skillsBaseDir, 'ax');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L18

index.cjsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.cjsView on unpkg

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L762

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 73ff367787d501ba signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.cjsView on unpkg

index.global.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg

index.d.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg

Findings

2 Critical8 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

CriticalPrevious Version Dangerous Deltaindex.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighCommand Output Exfiltrationindex.js

HighTrigger Reachable Command Output Exfiltrationindex.cjs

HighKnown Malware Source Similarityindex.cjs

HighKnown Malware Source Similarityindex.global.js

HighKnown Malware Source Similarityindex.d.ts

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @ax-llm/ax@24.0.20.

See version security history for other recorded verdicts.

Review the evidence and your use of @ax-llm/ax@24.0.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 15:40:34.426Z (UTC).