Loading npm security reports…

@ax-llm/ax@24.0.9: AI-agent control-surface risk | LPM Firewall

registry / @ax-llm/ax / 24.0.9

@ax-llm/ax@24.0.9

The best library to work with LLMs

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the library automatically changes the consumer project's Claude Code skill configuration. It removes legacy skill files and installs or upgrades bundled skills.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes the postinstall lifecycle hook.

Impact

The package injects package-controlled instructions into a foreign AI-agent control surface without an explicit setup command.

Mechanism

Automatic write and deletion in the consumer .claude/skills directory.

Policy narrative

On installation, package.json launches scripts/postinstall.mjs. That script finds the consumer project root, deletes legacy Markdown files below .claude/skills/ax, and copies all bundled skill documents into .claude/skills directories. Claude Code can load these files as agent instructions, so an ordinary dependency installation mutates a foreign AI-agent control surface without a separate user-authorized setup action.

AI rationale

The automatic postinstall hook mutates a consumer-owned Claude Code configuration and removes existing files. This is concrete unconsented install-hook abuse despite the absence of observed network or shell execution.

Evidence

package.jsonscripts/postinstall.mjs.claude/skills/ax/*.md.claude/skills/<skill-name>/SKILL.mdskills/*.md

Decision evidence

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

763- Phrase rules so they generalize to the failure mode, not this one task. L764: - Ignore signals that are one-off noise with no reusable lesson.`}var Hw={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L765: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Su=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))break;I-=1}return I},z=v=...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L763

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.5 matchedPath = index.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

765${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Su=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))break;I-=1}return I},z=v=...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L765

765${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var Su=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))break;I-=1}return I},z=v=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L765

scripts/postinstall.mjsView file

18existsSync, L19: mkdirSync, L20: readFileSync, ... L22: rmSync, L23: writeFileSync, L24: } from 'node:fs'; ... L190: const projectRoot = findProjectRoot(); L191: const skillsBaseDir = join(projectRoot, '.claude', 'skills'); L192: ... L205: L206: // Clean up legacy flat file structure (.claude/skills/ax/*.md except SKILL.md) L207: const legacyDir = join(skillsBaseDir, 'ax');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L18

index.cjsView file

763Trigger-reachable command-output exfiltration chain: manifest.main -> index.cjs L763: - Phrase rules so they generalize to the failure mode, not this one task. L764: - Ignore signals that are one-off noise with no reusable lesson.`}var LS={variant:"distiller",templateId:"rlm/distiller.md",executesTools:!1,ownsChildAgents:!1,seesContextMap:!0,se... L765: ${typeof d=="string"?d:JSON.stringify(d)}`:"",Object.keys(c.actorFieldValues??{}).length>0?` L766: ${JSON.stringify(c.actorFieldValues)}`:""].join("")},o=e.agentIdentity?.namespace;return{...t,...o?{namespace:o}:{},func:n}}var ac=(c=>(c.NETWORK="network",c.STORAGE="storage",c.CO... L767: `),$=v=>{let I=v.trim();return I.startsWith("//")||I.startsWith("/*")||I.startsWith("*")},S=v=>{let I=v.length-1;for(;I>=0;){let q=v[I].trim();if(q&&!$(q))

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

index.cjsView on unpkg · L763

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.5 matchedPath = index.cjs matchedIdentity = npm:QGF4LWxsbS9heA:24.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.cjsView on unpkg

index.global.jsView file

•matchType = normalized_sha256 matchedPackage = @ax-llm/ax@24.0.5 matchedPath = index.global.js matchedIdentity = npm:QGF4LWxsbS9heA:24.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.global.jsView on unpkg