Loading npm security reports…

@babylonjs-toolkit/agent@1.1.2: AI-agent control-surface risk | LPM Firewall

registry / @babylonjs-toolkit/agent / 1.1.2

@babylonjs-toolkit/agent@1.1.2

Installs the Babylon Toolkit agent skills and Agent Persona for Claude Code, Codex, GitHub Copilot, Gemini CLI and Antigravity.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall mutates several unrelated AI-agent configuration surfaces. It installs a persistent persona that directs future agent sessions to retrieve remote instructions.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install -g @babylonjs-toolkit/agent

Impact

Future Claude, Codex, Gemini, and shared-agent sessions can receive package-controlled instructions and remotely changeable content without an explicit setup command.

Mechanism

Automatic multi-agent instruction-file mutation and remote instruction loading

Policy narrative

Installing the package globally invokes postinstall automatically. That hook installs skills and writes persona content into the global instruction files of several AI tools. The persona requires affected agents to fetch a mutable GitHub-hosted reference before Babylon-related work, creating a persistent remote instruction channel across unrelated agent control surfaces.

AI rationale

This is an unconsented install-time mutation of broad foreign AI-agent control surfaces, amplified by a mandatory remote instruction fetch. The behavior is concrete and reachable from the package lifecycle hook.

Evidence

package.jsonscripts/postinstall.jslib/install.jslib/targets.jspersona.md~/.claude/skills~/.claude/CLAUDE.md~/.agents/skills~/.agents/AGENTS.md~/.codex/AGENTS.md~/.gemini/GEMINI.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/selfupdate.jsView file

4const path = require('path'); L5: const { execFileSync } = require('child_process'); L6:

High

Child Process

Package source references child process execution.

lib/selfupdate.jsView on unpkg · L4

143const script = ` L144: const https = require('https'); L145: const url = 'https://registry.npmjs.org/' + encodeURIComponent(${JSON.stringify(PACKAGE_NAME)}).replace('%40','@') + '/latest'; ... L149: res.on('end', () => { L150: try { process.stdout.write(String(JSON.parse(body).version || '')); } catch { process.stdout.write(''); } L151: }); ... L156: try { L157: const out = execFileSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: timeout + 2000 }); L158: return String(out).trim() || null;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/selfupdate.jsView on unpkg · L143

143Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/bt-agent.js -> lib/selfupdate.js L143: const script = ` L144: const https = require('https'); L145: const url = 'https://registry.npmjs.org/' + encodeURIComponent(${JSON.stringify(PACKAGE_NAME)}).replace('%40','@') + '/latest'; ... L149: res.on('end', () => { L150: try { process.stdout.write(String(JSON.parse(body).version || '')); } catch { process.stdout.write(''); } L151: }); ... L156: try { L157: const out = execFileSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: timeout + 2000 }); L158: return String(out).trim() || null;

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/selfupdate.jsView on unpkg · L143

lib/targets.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L20: default: true, L21: global: { skills: '~/.claude/skills', instructions: '~/.claude/CLAUDE.md' }, L22: project: { skills: '.claude/skills', instructions: 'CLAUDE.md' }, L23: }, ... L27: default: true, L28: global: { skills: '~/.agents/skills', instructions: '~/.agents/AGENTS.md' }, L29: project: { skills: '.agents/skills', instructions: 'AGENTS.md' }, L30: }, ... L34: default: true, L35: global: { skills: null, instructions: '~/.codex/AGENTS.md' }, L36: project: { skills: null, instructions: 'AGENTS.md' }, L37: }, Write operation from lib/payload.js: L45: function copyDir(src, dest) { L46: fs.mkdirSync(dest, { recursive: true }); L47: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L51: if (e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/targets.jsView on unpkg · L1

skills/bt-atlas/scripts/preview.pyView file

•path = skills/bt-atlas/scripts/preview.py kind = build_helper sizeBytes = 2478 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/bt-atlas/scripts/preview.pyView on unpkg

Lines 123-163javascript

123function fetchLatestVersion({ timeout = 20000 } = {}) {

124 try {

125 const out = execFileSync(npmBin(), ['view', PACKAGE_NAME, 'version'], {

126 encoding: 'utf8',

127 timeout,

128 stdio: ['ignore', 'pipe', 'pipe'],

129 });

130 const v = String(out).trim().split(/\s+/).pop();

131 if (v) return { version: v };

132 } catch (err) {

133 const reason = (err && (err.stderr || err.message) ? String(err.stderr || err.message) : '').trim();

134 const fallback = fetchLatestFromRegistrySync(timeout);

135 if (fallback) return { version: fallback };

136 return { error: reason.split('\n').filter(Boolean).pop() || 'could not reach the npm registry' };

137 }

138 return { error: 'npm returned no version' };

139}

140

141/** Registry lookup without the npm CLI. Runs in a helper process so it can be sync. */

142function fetchLatestFromRegistrySync(timeout) {

143 const script = `

144 const https = require('https');

145 const url = 'https://registry.npmjs.org/' + encodeURIComponent(${JSON.stringify(PACKAGE_NAME)}).replace('%40','@') + '/latest';

146 const req = https.get(url, { headers: { accept: 'application/json' } }, (res) => {

147 let body = '';

148 res.on('data', (c) => { body += c; });

149 res.on('end', () => {

150 try { process.stdout.write(String(JSON.parse(body).version || '')); } catch { process.stdout.write(''); }

151 });

152 });

153 req.setTimeout(${Math.max(1000, timeout)}, () => req.destroy());

154 req.on('error', () => process.stdout.write(''));

155 `;

156 try {

157 const out = execFileSync(process.execPath, ['-e', script], { encoding: 'utf8', timeout: timeout + 2000 });

158 return String(out).trim() || null;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/selfupdate.jsView on unpkg · L143

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/selfupdate.jsView on unpkg · L143

159 } catch {

160 return null;

161 }

162}

163