registry / @ax-llm/ax / 24.0.3

@ax-llm/ax@24.0.3

The best library to work with LLMs

AI Security Review

scanned 18d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An npm postinstall hook automatically modifies the consuming project's Claude Code skill directory. No confirmed exfiltration or code execution attack was identified.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package when the skip and CI checks do not apply.

Impact

This changes an AI-agent control surface without an explicit setup command and can alter future Claude Code behavior in the project.

Mechanism

The lifecycle script copies bundled Markdown skills to .claude/skills and deletes selected legacy skill files.

AI rationale

Automatic postinstall mutation of a consumer AI-agent configuration warrants a warning. The observed code is limited to bundled first-party skill installation and legacy cleanup, so there is insufficient evidence of malware or a blocking attack chain.

Evidence

package.jsonscripts/postinstall.mjs.claude/skills

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The package registers an automatic postinstall hook.
The hook derives the consumer project root and writes bundled Claude Code skill files into its .claude/skills directory.
The hook removes legacy Markdown files in the consumer's .claude/skills/ax directory.

Evidence against

No network, subprocess, credential-harvesting, or remote-code execution is present in the inspected lifecycle script.
The installed files are bundled package skill documentation and version-aware replacement is limited to named skill targets.

Behavioral surface

Source

DynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 3.42 MB of source, external domains: ai.google.dev, api-docs.deepseek.com, api.anthropic.com, api.cerebras.ai, api.cohere.ai, api.deepinfra.com, api.deepseek.com, api.featherless.ai, api.fireworks.ai, api.friendli.ai, api.groq.com, api.hyperbolic.xyz, api.mistral.ai, api.novita.ai, api.openai.com, api.orcarouter.ai, api.reka.ai, api.sambanova.ai, api.scaleway.ai, api.siliconflow.com, api.studio.nebius.com, api.together.xyz, api.tokenfactory.nebius.com, api.x.ai, cloud.google.com, console.groq.com, developers.cloudflare.com, docs.anthropic.com, docs.aws.amazon.com, docs.baseten.co, docs.cloud.google.com, docs.cohere.com, docs.databricks.com, docs.deepinfra.com, docs.fireworks.ai, docs.hyperbolic.xyz, docs.mistral.ai, docs.nscale.com, docs.nvidia.com, docs.ollama.com, docs.ovhcloud.com, docs.reka.ai, docs.runpod.io, docs.sambanova.ai, docs.siliconflow.com, docs.together.ai, docs.vllm.ai, docs.x.ai, example.com, featherless.ai

Source & flagged code

12 flagged

package.jsonView file

Lines 34-56json

34 "author": "Vikram <https://twitter.com/dosco>",

35 "main": "./index.cjs",

36 "module": "./index.js",

37 "exports": {

38 ".": {

39 "types": "./index.d.ts",

40 "import": "./index.js",

41 "require": "./index.cjs"

42 },

43 "./*": {

44 "types": "./*.d.ts",

45 "import": "./*.js",

46 "require": "./*.cjs"

47 },

48 "./index.global.js": "./index.global.js"

49 },

50 "bin": {

51 "ax": "./cli/index.mjs"

52 },

53 "scripts": {

54 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 }

56}

index.jsView file

763- Phrase rules so they generalize to the failure mode, not this one task. L764: - Ignore signals that are one-off noise with no reusable lesson.`}var Hw={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L765: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Su=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))break;I-=1}return I},z=v=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L763

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.9 matchedPath = index.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

765${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Su=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))break;I-=1}return I},z=v=...

scripts/postinstall.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

3/**

4 * Postinstall script for @ax-llm/ax

5 *

6 * Auto-installs/upgrades the Claude Code skill on package install.

7 *

8 * Features:

9 * - Skips in CI environments (CI, CONTINUOUS_INTEGRATION env vars)

10 * - Skips if AX_SKIP_SKILL_INSTALL=1

11 * - Silent failure (never breaks package installation)

index.cjsView file

763Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L763: - Phrase rules so they generalize to the failure mode, not this one task. L764: - Ignore signals that are one-off noise with no reusable lesson.`}var LS={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L765: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var ac=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L763

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.9 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 09517191b423464b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ax-llm/ax@24.0.9 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.9 similarity = 1.000 shingleOverlap = 6 summary = package final verdict is malicious

index.global.jsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.9 matchedPath = index.global.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg

index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.9 matchedPath = index.d.ts matchedIdentity = npm:QGF4LWxsbS9heA:24.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L763

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L765

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L765

scripts/postinstall.mjsView file

18existsSync, L19: mkdirSync, L20: readFileSync, ... L22: rmSync, L23: writeFileSync, L24: } from 'node:fs'; ... L190: const projectRoot = findProjectRoot(); L191: const skillsBaseDir = join(projectRoot, '.claude', 'skills'); L192: ... L205: L206: // Clean up legacy flat file structure (.claude/skills/ax/*.md except SKILL.md) L207: const legacyDir = join(skillsBaseDir, 'ax');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L18

index.cjsView file

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L763

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.cjsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.cjsView on unpkg

index.global.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg

index.d.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.d.tsView on unpkg

Findings

1 Critical8 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/postinstall.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighCommand Output Exfiltrationindex.js

HighTrigger Reachable Command Output Exfiltrationindex.cjs

HighKnown Malware Source Similarityindex.cjs

HighKnown Malware Source Similarityindex.global.js

HighKnown Malware Source Similarityindex.d.ts

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.cjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @ax-llm/ax@24.0.3.

See version security history for other recorded verdicts.

Review the evidence and your use of @ax-llm/ax@24.0.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-20 08:23:11.301Z (UTC).