Loading npm security reports…

@babylonjs-toolkit/agent@1.1.12: AI-agent control-surface risk | LPM Firewall

registry / @babylonjs-toolkit/agent / 1.1.12

@babylonjs-toolkit/agent@1.1.12

Installs the Babylon Toolkit agent skills and Agent Persona for Claude Code, Codex, GitHub Copilot, Gemini CLI and Antigravity.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall writes skills, instruction personas, and Codex settings into multiple AI-agent control surfaces. It enables Codex network access and installs a persona that mandates a remote fetch for matching requests.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global installation of the package, through its postinstall hook.

Impact

It can change the behavior and network permissions of several AI-agent tools without an explicit setup command.

Mechanism

Automatic mutation of global AI-agent instructions, skills, and configuration.

Policy narrative

On global installation, the postinstall hook invokes the installer without a user command. The installer targets Claude, shared agent, Codex, and Gemini global instruction and skill locations, changes Codex configuration to enable network access, and prepends a persona. That persona directs agents to fetch a remotely hosted reference before responding to Babylon-related requests, creating a persistent remote instruction channel across agent products.

AI rationale

This is unconsented postinstall mutation of broad, foreign AI-agent control surfaces, including activation of network access and remote instruction loading. The behavior meets the install-time AI-agent control-hijack blocking boundary.

Evidence

scripts/postinstall.jslib/targets.jslib/codex-config.jspersona.mdskills/.codex/config.toml~/.claude/skills~/.claude/CLAUDE.md~/.agents/skills

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/selfupdate.jsView file

4const path = require('path'); L5: const { execFileSync } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

lib/selfupdate.jsView on unpkg · L4

207const script = ` L208: const https = require('https'); L209: const url = 'https://registry.npmjs.org/' + encodeURIComponent(${JSON.stringify(PACKAGE_NAME)}).replace('%40','@') + '/latest'; ... L213: res.on('end', () => { L214: try { process.stdout.write(String(JSON.parse(body).version || '')); } catch { process.stdout.write(''); } L215: }); ... L220: try { L221: const out = execFileSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: timeout + 2000 }); L222: return String(out).trim() || null;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/selfupdate.jsView on unpkg · L207

207Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/bt-agent.js -> lib/selfupdate.js L207: const script = ` L208: const https = require('https'); L209: const url = 'https://registry.npmjs.org/' + encodeURIComponent(${JSON.stringify(PACKAGE_NAME)}).replace('%40','@') + '/latest'; ... L213: res.on('end', () => { L214: try { process.stdout.write(String(JSON.parse(body).version || '')); } catch { process.stdout.write(''); } L215: }); ... L220: try { L221: const out = execFileSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: timeout + 2000 }); L222: return String(out).trim() || null;

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/selfupdate.jsView on unpkg · L207

•matchType = normalized_sha256 matchedPackage = @babylonjs-toolkit/agent@1.1.6 matchedPath = lib/selfupdate.js matchedIdentity = npm:[redacted]:1.1.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/selfupdate.jsView on unpkg

lib/targets.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L20: default: true, L21: global: { skills: '~/.claude/skills', instructions: '~/.claude/CLAUDE.md' }, L22: project: { skills: '.claude/skills', instructions: 'CLAUDE.md' }, L23: }, ... L27: default: true, L28: global: { skills: '~/.agents/skills', instructions: '~/.agents/AGENTS.md' }, L29: project: { skills: '.agents/skills', instructions: 'AGENTS.md' }, L30: }, ... L34: default: true, L35: global: { skills: null, instructions: '~/.codex/AGENTS.md', config: '~/.codex/config.toml' }, L36: project: { skills: null, instructions: 'AGENTS.md', config: '.codex/config.toml' }, L37: }, Write operation from lib/codex-config.js: L80: } L81: const template = fs.readFileSync(path.join(PACKAGE_ROOT, '.codex', 'config.toml'), 'utf8'

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/targets.jsView on unpkg · L1

skills/bt-atlas/scripts/preview.pyView file

•path = skills/bt-atlas/scripts/preview.py kind = build_helper sizeBytes = 2478 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/bt-atlas/scripts/preview.pyView on unpkg

Lines 187-227javascript

187function fetchLatestVersion({ timeout = 20000 } = {}) {

188 try {

189 const out = runManager('npm', ['view', PACKAGE_NAME, 'version'], {

190 encoding: 'utf8',

191 timeout,

192 stdio: ['ignore', 'pipe', 'pipe'],

193 });

194 const v = String(out).trim().split(/\s+/).pop();

195 if (v) return { version: v };

196 } catch (err) {

197 const reason = (err && (err.stderr || err.message) ? String(err.stderr || err.message) : '').trim();

198 const fallback = fetchLatestFromRegistrySync(timeout);

199 if (fallback) return { version: fallback };

200 return { error: reason.split('\n').filter(Boolean).pop() || 'could not reach the npm registry' };

201 }

202 return { error: 'npm returned no version' };

203}

204

205/** Registry lookup without the npm CLI. Runs in a helper process so it can be sync. */

206function fetchLatestFromRegistrySync(timeout) {

207 const script = `

208 const https = require('https');

209 const url = 'https://registry.npmjs.org/' + encodeURIComponent(${JSON.stringify(PACKAGE_NAME)}).replace('%40','@') + '/latest';

210 const req = https.get(url, { headers: { accept: 'application/json' } }, (res) => {

211 let body = '';

212 res.on('data', (c) => { body += c; });

213 res.on('end', () => {

214 try { process.stdout.write(String(JSON.parse(body).version || '')); } catch { process.stdout.write(''); }

215 });

216 });

217 req.setTimeout(${Math.max(1000, timeout)}, () => req.destroy());

218 req.on('error', () => process.stdout.write(''));

219 `;

220 try {

221 const out = execFileSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: timeout + 2000 });

222 return String(out).trim() || null;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/selfupdate.jsView on unpkg · L207

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/selfupdate.jsView on unpkg · L207

223 } catch {

224 return null;

225 }

226}

227