Loading npm security reports…

@ax-llm/ax@24.0.21: AI-agent control-surface risk | LPM Firewall

registry / @ax-llm/ax / 24.0.21

@ax-llm/ax@24.0.21

The best library to work with LLMs

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall copies this package's Claude skill files into the consumer project's .claude/skills directory and removes older flat skill files there.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall, unless a CI variable or AX_SKIP_SKILL_INSTALL is set.

Impact

Claude Code can load package-authored skill instructions in the project without a separate user setup command.

Mechanism

The script resolves the project root from INIT_CWD or the node_modules path, then creates .claude/skills/<name>/SKILL.md and writes each packaged skill into it.

Policy narrative

Installing @ax-llm/ax runs scripts/postinstall.mjs. Unless CI or AX_SKIP_SKILL_INSTALL is set, the script locates the project root and writes each skills/*.md file to .claude/skills/<skill>/SKILL.md, replacing a copy when the packaged version is newer. It also deletes legacy markdown under .claude/skills/ax. Errors are ignored and the notice is printed only on a TTY. That places package-authored agent instructions on Claude Code's project skill surface during install.

AI rationale

The postinstall hook writes this package's skill files into Claude Code's project .claude/skills directory without an opt-in command. That is unconsented install-time mutation of a foreign agent control surface and should be blocked.

Evidence

package.jsonscripts/postinstall.mjs.claude/skills

Decision evidence

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

762- Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var ak={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L762

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L764

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L764

scripts/postinstall.mjsView file

18existsSync, L19: mkdirSync, L20: readFileSync, ... L22: rmSync, L23: writeFileSync, L24: } from 'node:fs'; ... L190: const projectRoot = findProjectRoot(); L191: const skillsBaseDir = join(projectRoot, '.claude', 'skills'); L192: ... L205: L206: // Clean up legacy flat file structure (.claude/skills/ax/*.md except SKILL.md) L207: const legacyDir = join(skillsBaseDir, 'ax');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L18

index.cjsView file

762Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L762: - Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var Zk={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Gc=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L762

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 73ff367787d501ba signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

index.global.jsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.global.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg

index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.d.ts matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 34-56json

34 "author": "Vikram <https://twitter.com/dosco>",

35 "main": "./index.cjs",

36 "module": "./index.js",

37 "exports": {

38 ".": {

39 "types": "./index.d.ts",

40 "import": "./index.js",

41 "require": "./index.cjs"

42 },

43 "./*": {

44 "types": "./*.d.ts",

45 "import": "./*.js",

46 "require": "./*.cjs"

47 },

48 "./index.global.js": "./index.global.js"

49 },

50 "bin": {

51 "ax": "./cli/index.mjs"

52 },

53 "scripts": {

54 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 }

56}

index.jsView file

762- Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var ak={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L762

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Ad=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))break;P-=1}return P},E=w=...

scripts/postinstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2

3/**

4 * Postinstall script for @ax-llm/ax

5 *

6 * Auto-installs/upgrades the Claude Code skill on package install.

7 *

8 * Features:

9 * - Skips in CI environments (CI, CONTINUOUS_INTEGRATION env vars)

10 * - Skips if AX_SKIP_SKILL_INSTALL=1

11 * - Silent failure (never breaks package installation)

index.cjsView file

762Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L762: - Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var Zk={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Gc=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),G=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},L=w=>{let P=w.length-1;for(;P>=0;){let H=w[P].trim();if(H&&!G(H))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L762

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 73ff367787d501ba signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

index.global.jsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.global.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg

index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.19 matchedPath = index.d.ts matchedIdentity = npm:QGF4LWxsbS9heA:24.0.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg