Loading npm security reports…

@axiomantic/garden@0.1.1: AI-agent control-surface risk | LPM Firewall

registry / @axiomantic/garden / 0.1.1

@axiomantic/garden@0.1.1

Multi-Agent Swarm Orchestration, Empirical Dialectics & Ceremonies on top of Rhizo & Vine

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An automatic installation hook modifies configuration for independently installed AI coding assistants. It also retrieves and installs an opaque native executable during installation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package invokes its post-installation hook.

Impact

Package installation can silently alter AI-agent control instructions and introduce an uninspected executable without an explicit user command.

Mechanism

The hook detects assistant configuration directories, deletes a prior rules file, and writes a replacement; it also downloads and extracts a release binary.

Policy narrative

Installing the package automatically runs a script that detects existing Claude Code and OpenCode configurations. It removes a named rules file and provisions Garden rules into those third-party agent control locations. In the same automatic hook, it downloads and extracts a native binary from a release endpoint. This is unconsented installation-time modification of a broad AI-agent control surface.

AI rationale

The automatic hook modifies foreign AI-agent rule directories and deletes existing configuration, which meets the install-control-surface blocking policy. Its automatic remote native-binary download increases the installation-time supply-chain risk.

Evidence

package.jsonscripts/postinstall.js.claude/rules/agora.md.claude/rules/garden.md.config/opencode/instructions/agora.md.config/opencode/instructions/garden.md

Network endpoints

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

19"postinstall": "node scripts/postinstall.js" }, "publishConfig": { "access": "public" }, "reposito

High

Ai Review Evidence

The manifest automatically runs the installation script after package installation.

package.jsonView on unpkg · L19

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: L36: if (!fs.existsSync(binDir)) fs.mkdirSync(binDir, { recursive: true }); L37: ... L104: if (!fs.existsSync(destDir)) { L105: fs.mkdirSync(destDir, { recursive: true }); L106: } L107: const target = path.join(destDir, fileName); L108: fs.writeFileSync(target, content, 'utf8'); L109: console.log(`[${PKG_NAME}] Provisioned rules to: ${target}`); ... L125: // Claude Code L126: const claudeDir = path.join(home, '.claude'); L127: if (fs.existsSync(claudeDir)) { Payload evidence from skills/choose-personas/SKILL.md: L1: --- L2: name: choose-personas

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

115function cleanAndInstall(destDir, oldName, newName) { try { const oldPath = path.join(destDir, oldName); if (fs.existsSync(oldPath)) { try { fs.unlinkSync(oldPath); } catch (_) {} } safeWrite(destDir, newName, guideContent); } catch (_) {} } // Claude Code const claudeDir = path.join(home, '.claude'); if (fs.existsSync(claudeDir)) { cleanAndInstall(path.join(claudeDir, 'rules'), 'agora.md', 'garden.md'); } // OpenCode const opencodeDir = path.join(home, '.config', 'opencode'); if (fs.existsSync(opencodeDir)) { cleanAndInst

High

Ai Review Evidence

The installation script removes an existing assistant rule file and writes its own rule file into detected Claude Code and OpenCode configuration directories.

scripts/postinstall.jsView on unpkg · L115

bin/gardenView file

•path = bin/garden kind = native_binary sizeBytes = 268360 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/gardenView on unpkg

scripts/launch_tmux_swarm.shView file

•path = scripts/launch_tmux_swarm.sh kind = build_helper sizeBytes = 6927 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/launch_tmux_swarm.shView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "@axiomantic/garden",

3 "version": "0.1.1",

4 "description": "Multi-Agent Swarm Orchestration, Empirical Dialectics & Ceremonies on top of Rhizo & Vine",

5 "main": "bin/run.js",

6 "bin": {

7 "garden": "bin/run.js"

8 },

9 "skills": "./skills",

10 "files": [

11 "bin/",

12 "scripts/",

13 "skills/",

14 "SKILL.md",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L19

20 },

21 "publishConfig": {

22 "access": "public"

23 },

24 "repository": {

High

Ai Review Evidence

The manifest automatically runs the installation script after package installation.

package.jsonView on unpkg · L19

25 "type": "git",

26 "url": "git+https://github.com/axiomantic/garden.git"

27 },

28 "keywords": [

29 "multi-agent",

30 "ai-agents",

31 "orchestration",

32 "tmux",

33 "dialectics",

34 "rhizo",

35 "vine",

36 "garden",

37 "swarm"

38 ],

39 "author": "Axiomantic",

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const fs = require('fs');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

3const path = require('path'

bin/gardenView file

•path = bin/garden kind = native_binary sizeBytes = 268360 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/gardenView on unpkg

scripts/launch_tmux_swarm.shView file

•path = scripts/launch_tmux_swarm.sh kind = build_helper sizeBytes = 6927 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/launch_tmux_swarm.shView on unpkg