Loading npm security reports…

@axiomantic/rhizo@0.1.4: AI-agent control-surface risk | LPM Firewall

registry / @axiomantic/rhizo / 0.1.4

@axiomantic/rhizo@0.1.4

Inter-assistant communication bus, monotonic fencing locks, and work queues over Redis

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. The automatic installer mutates several existing AI-agent control surfaces in the user's home directory. It also installs a plugin capable of interrupting an active OpenCode session.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Installing the package runs the npm postinstall hook.

Impact

An npm install can change the behavior and control flow of unrelated AI-agent tools without an explicit setup command or consent.

Mechanism

The hook writes agent rule files and copies a plugin into an existing OpenCode plugin directory; the plugin invokes the session abort interface.

Policy narrative

On installation, the package automatically detects multiple user-level AI-agent installations and writes rules into them. For OpenCode it also installs a plugin that can abort a busy session to inject its own delivery flow. This is an unconsented postinstall mutation of broad, foreign agent control surfaces.

AI rationale

This is concrete install-hook abuse: an automatic npm lifecycle hook changes multiple unrelated AI-agent configurations and installs a session-controlling plugin. The conditional directory checks do not provide user consent.

Evidence

package.jsonscripts/postinstall.jsskills/rhizo/opencode-ear.js

Decision evidence

public snapshot

with false-positive risk.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

19"postinstall": "node scripts/postinstall.js" }, "publishConfig": { "acce

High

Ai Review Evidence

The package runs its installer automatically after npm installation.

package.jsonView on unpkg · L19

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

35L36: if (!fs.existsSync(binDir)) fs.mkdirSync(binDir, { recursive: true }); L37: ... L128: if (!fs.existsSync(destDir)) { L129: fs.mkdirSync(destDir, { recursive: true }); L130: } L131: const target = path.join(destDir, fileName); L132: fs.writeFileSync(target, content, 'utf8'); L133: console.log(`[${PKG_NAME}] Provisioned rules to: ${target}`); ... L139: // Claude Code L140: const claudeDir = path.join(home, '.claude'); L141: if (fs.existsSync(claudeDir)) {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L35

•matchType = previous_version_dangerous_delta matchedPackage = @axiomantic/rhizo@0.1.5 matchedIdentity = npm:QGF4aW9tYW50aWMvcmhpem8:0.1.5 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/postinstall.jsView on unpkg

bin/rhizoView file

•path = bin/rhizo kind = native_binary sizeBytes = 1450376 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/rhizoView on unpkg

scripts/ci/build.shView file

•path = scripts/ci/build.sh kind = build_helper sizeBytes = 882 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/ci/build.shView on unpkg