Loading npm security reports…

@ax-llm/ax@24.0.24: AI-agent control-surface risk | LPM Firewall

registry / @ax-llm/ax / 24.0.24

@ax-llm/ax@24.0.24

The best library to work with LLMs

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the postinstall hook writes this package's Claude Code skill files into the installing project's .claude/skills tree and removes older skill markdown there. That directory is Claude Code's project skill control surface, and the install does not ask the user first.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Automatic npm postinstall of @ax-llm/ax outside CI and without AX_SKIP_SKILL_INSTALL.

Impact

Claude Code in that project loads the package-authored skills and follows them when generating code, without a separate user setup command.

Mechanism

install() resolves the consumer project from INIT_CWD or the path above node_modules, then mkdir and writeFileSync each skills/*.md file to .claude/skills/<skill name>/SKILL.md, and rmSync legacy files under .claude/skills/ax.

Policy narrative

Installing @ax-llm/ax runs scripts/postinstall.mjs. Unless a CI variable or AX_SKIP_SKILL_INSTALL is set, the script locates the consumer project and writes every bundled skill into .claude/skills/<name>/SKILL.md, upgrading when the embedded version is newer. It also deletes leftover markdown in .claude/skills/ax. Those files are Claude Code skills, so the coding agent picks up package instructions on the next session. The separate setup-claude command is not required for this write.

AI rationale

The postinstall hook silently mutates Claude Code's project skill directory, a foreign agent control surface, and the written files are instructions the agent will follow. That install-time control-surface write is concrete attack behavior even though the skill text is library documentation and the hook has no network or credential theft.

Evidence

package.jsonscripts/postinstall.mjs

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 91.0% confidence with low false-positive risk.

Evidence for policy risk

package.json registers a postinstall script that runs node ./scripts/postinstall.mjs during npm install.
scripts/postinstall.mjs calls install() at load and copies bundled markdown into the consumer project .claude/skills directory with no consent prompt.
The same postinstall deletes preexisting markdown files under .claude/skills/ax except SKILL.md.
skills/ax-agent.md is a Claude Code skill document whose frontmatter name and description tell an LLM how to generate Ax agent code.
Skip conditions are limited to CI environment variables and AX_SKIP_SKILL_INSTALL; a normal local install still writes the skills.

Evidence against

The copied skills are library usage guides rather than obfuscated payloads.
The postinstall script does not open network connections, read credentials, spawn a shell, or eval remote code.
An explicit ax setup-claude command performs a similar copy only when the user runs it.

Behavioral surface

Source

DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 3.77 MB of source, external domains: ai.google.dev, api-docs.deepseek.com, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepinfra.com, api.deepseek.com, api.featherless.ai, api.fireworks.ai, api.friendli.ai, api.groq.com, api.hyperbolic.xyz, api.meta.ai, api.mistral.ai, api.novita.ai, api.openai.com, api.orcarouter.ai, api.reka.ai, api.sambanova.ai, api.scaleway.ai, api.siliconflow.com, api.studio.nebius.com, api.together.xyz, api.tokenfactory.nebius.com, api.typesafe.ai, api.x.ai, cloud.google.com, console.groq.com, dev.meta.ai, developers.cloudflare.com, docs.anthropic.com, docs.aws.amazon.com, docs.baseten.co, docs.cloud.google.com, docs.cohere.com, docs.databricks.com, docs.deepinfra.com, docs.fireworks.ai, docs.hyperbolic.xyz, docs.mistral.ai, docs.nscale.com, docs.nvidia.com, docs.ollama.com, docs.ovhcloud.com, docs.reka.ai, docs.runpod.io, docs.sambanova.ai, docs.siliconflow.com, docs.together.ai, docs.typesafe.ai

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

762- Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var Kk={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Md=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))break;P-=1}return P},_=w=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L762

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Md=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))break;P-=1}return P},_=w=...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L764

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Md=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))break;P-=1}return P},_=w=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L764

scripts/postinstall.mjsView file

18existsSync, L19: mkdirSync, L20: readFileSync, ... L22: rmSync, L23: writeFileSync, L24: } from 'node:fs'; ... L190: const projectRoot = findProjectRoot(); L191: const skillsBaseDir = join(projectRoot, '.claude', 'skills'); L192: ... L205: L206: // Clean up legacy flat file structure (.claude/skills/ax/*.md except SKILL.md) L207: const legacyDir = join(skillsBaseDir, 'ax');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L18

index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ax-llm/ax@24.0.23 matchedIdentity = npm:QGF4LWxsbS9heA:24.0.23 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.cjsView on unpkg

762Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L762: - Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var DT={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Yc=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L762

index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.21 matchedPath = index.d.ts matchedIdentity = npm:QGF4LWxsbS9heA:24.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 34-56json

34 "author": "Vikram <https://twitter.com/dosco>",

35 "main": "./index.cjs",

36 "module": "./index.js",

37 "exports": {

38 ".": {

39 "types": "./index.d.ts",

40 "import": "./index.js",

41 "require": "./index.cjs"

42 },

43 "./*": {

44 "types": "./*.d.ts",

45 "import": "./*.js",

46 "require": "./*.cjs"

47 },

48 "./index.global.js": "./index.global.js"

49 },

50 "bin": {

51 "ax": "./cli/index.mjs"

52 },

53 "scripts": {

54 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 }

56}

index.jsView file

762- Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var Kk={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Md=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))break;P-=1}return P},_=w=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L762

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Md=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))break;P-=1}return P},_=w=...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L764

764${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Md=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))break;P-=1}return P},_=w=...

scripts/postinstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2

3/**

4 * Postinstall script for @ax-llm/ax

5 *

6 * Auto-installs/upgrades the Claude Code skill on package install.

7 *

8 * Features:

9 * - Skips in CI environments (CI, CONTINUOUS_INTEGRATION env vars)

10 * - Skips if AX_SKIP_SKILL_INSTALL=1

11 * - Silent failure (never breaks package installation)

index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ax-llm/ax@24.0.23 matchedIdentity = npm:QGF4LWxsbS9heA:24.0.23 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.cjsView on unpkg

762Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L762: - Phrase rules so they generalize to the failure mode, not this one task. L763: - Ignore signals that are one-off noise with no reusable lesson.`}var DT={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L764: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L765: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Yc=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L766: `),O=w=>{let P=w.trim();return P.startsWith("//")||P.startsWith("/*")||P.startsWith("*")},N=w=>{let P=w.length-1;for(;P>=0;){let W=w[P].trim();if(W&&!O(W))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L762

index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.21 matchedPath = index.d.ts matchedIdentity = npm:QGF4LWxsbS9heA:24.0.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg