Loading npm security reports…

@baize-ai/core@0.3.1: AI-agent control-surface risk | LPM Firewall

registry / @baize-ai/core / 0.3.1

@baize-ai/core@0.3.1

Baize (白泽) — autonomous AI agent infrastructure

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm postinstall, an already initialized Baize installation with existing Codex state has its global Codex configuration modified. It enables hooks and pre-trusts the Baize project, then installs a SessionStart hook configuration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of this package after ~/baize/.claude exists and ~/.codex/config.toml or ~/.codex/auth.json exists

Impact

Changes a foreign global AI-agent control surface without an explicit CLI setup command, enabling package-managed agent hooks.

Mechanism

postinstall-driven global Codex trust and hook enablement

Policy narrative

Installing the package invokes postinstall. If a Baize directory is initialized and any Codex state exists, the install path refreshes Codex configuration without the user running `baize init`: it writes the global Codex config, enables hooks, marks the Baize project trusted, and installs SessionStart hooks. This is unconsented install-time mutation of a global AI-agent control surface.

Rationale

The source confirms a concrete postinstall chain that mutates global Codex trust and hook settings based solely on pre-existing state. This meets the install-control-surface block boundary despite the absence of credential exfiltration.

Evidence

package.jsonscripts/postinstall.jscli/lib/sync-settings-hooks.jscli/lib/runtime-setup.jscli/lib/codex-hooks.js~/baize/.claude/settings.json~/baize/.codex/config.toml~/.codex/config.toml

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/lib/sync-settings-hooks.jsView file

21import os from 'os'; L22: import { execFileSync } from 'child_process'; L23: import { fileURLToPath } from 'url';

High

Child Process

Package source references child process execution.

cli/lib/sync-settings-hooks.jsView on unpkg · L21

cli/commands/init.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli/commands/init.js: isValidBaseUrl, saveClaudeBaseUrl, [redacted], saveCodexBaseUrl, saveCodexBaseUrlToEnv, fs.writeFileSync(envPath, content); fs.writeFileSync(envPath, content); * Save an Anthropic API key to ~/.claude/settings.json and process.env.

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli/commands/init.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli/commands/init.js: fs.writeFileSync(envPath, content); fs.writeFileSync(envPath, content); fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n'); fs.writeFileSync(claudeJsonPath, JSON.stringify(claudeJson, null, 2) + '\n'); fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n'); fs.writeFileSync(tmpEnv, `ANTHROPIC_API_KEY='${process.env.ANTHROPIC_API_KEY}'\n`, { mode: 0o600 }); console.log(' Please run the following command in another terminal:\n'); fs.writeFileSync(COMPONENTS_FILE, JSON.stringify({}, null, 2));

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli/commands/init.jsView on unpkg

9import fs from 'node:fs'; L10: import https from 'node:https'; L11: import os from 'node:os'; ... L13: import { createRequire } from 'node:module'; L14: import { execSync, execFileSync, spawnSync, spawn } from 'node:child_process'; L15: import { BAIZE_DIR, SKILLS_DIR, CONFIG_DIR, COMPONENTS_DIR, LOCKS_DIR, COMPONENTS_FILE, BIN_DIR, HTTP_DIR, CADDYFILE, CADDY_BIN, getBaizeConfig, updateBaizeConfig } from '../lib/co... ... L83: function installSystemPackage(pkg) { L84: const platform = process.platform; L85: const sudo = process.getuid?.() === 0 ? '' : 'sudo '; ... L120: function ensureLocalBinInProfile() { L121: const homedir = os.homedir(); L122: const shell = (process.env.SHELL || '').split('/').pop();

cli/commands/shell.jsView file

8import readline from 'node:readline'; L9: import net from 'node:net'; L10: import fs from 'node:fs'; ... L12: import path from 'node:path'; L13: import { execFileSync } from 'node:child_process'; L14: import { bold, dim, cyan } from '../lib/colors.js'; L15: L16: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(os.homedir(), 'baize'); L17: const C4_RECEIVE = path.join(BAIZE_DIR, '.claude', 'skills', 'comm-bridge', 'scripts', 'c4-receive.js');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli/commands/shell.jsView on unpkg · L8

scripts/postinstall.jsView file

17Install-time code directly mutates a foreign AI-agent control surface: L25: const BAIZE_DIR = process.env.BAIZE_DIR || path.join(process.env.HOME, 'baize'); L26: const SKILLS_DIR = path.join(BAIZE_DIR, '.claude', 'skills'); L27: const CORE_SKILLS_SRC = path.join(__dirname, '..', 'skills'); ... L92: const syncHooks = path.join(__dirname, '..', 'cli', 'lib', 'sync-settings-hooks.js'); L93: const templateSettings = path.join(__dirname, '..', 'templates', '.claude', 'settings.json'); L94: ... L112: L113: // Baize must be initialized — .claude/ directory exists after `baize init` L114: const claudeDir = path.join(BAIZE_DIR, '.claude'); L115: if (!fs.existsSync(claudeDir)) { Write operation from cli/lib/fs-utils.js: L17: base = path.join(os.homedir(), 'tmp'); L18: fs.mkdirSync(base, { recursiv

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L17

skills/create-skill/scripts/init-skill.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: const scriptsdir = path.join(skilldir, 'scripts'); fs.mkdirsync(scriptsdir); const examplescript = path.join(scriptsdir, 'example.js'); fs.writefilesync(examplescript, generateexamplescript(skillname)); fs.chmodsync(examplescript, 0o755); console.log('created scripts/example.js'); const refsdir = path.join(skilldir, 'references'); fs.mkdirsync(refsdir); fs.writefilesync(path.join(refsdir, 'api-reference.md'), generateexamplereference(skillname)); console.log('created references/api-reference.md'); const assetsdir = path.join(skilldir, 'assets'); fs.mkdirsync(assetsdir); fs.writefilesync(path.join(asset

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

skills/create-skill/scripts/init-skill.jsView on unpkg

cli/lib/runtime/codex.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. pts.bypasspermissions] - override default bypass setting * @returns {promise<void>} */ async launch(opts = {}) { const bypasspermissions = opts.bypasspermissions ?? default_bypass; assertinstructionready('codex'); // 1. ensure .agents/skills → .claude/skills symlink for codex skill discovery. const agentsdir = path.join(baize_dir, '.agents'); const agentsskillspath = path.join(agentsdir, 'skills'); let agentsskillsexists = false; try { fs.lstatsync(agentsskillspath); agentsskillsexists = true; } catch { /* not present */ } if (!agentsskillsexists) { try { fs.mkdirsync(agentsdir, { recursive: true }); fs.symlinksync(s

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

cli/lib/runtime/codex.jsView on unpkg

cli/lib/upgrade.jsView file

509try { L510: execSync('npm install --omit=dev', { L511: cwd: ctx.skillDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/lib/upgrade.jsView on unpkg · L509

docker/entrypoint.shView file

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 8961 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View file

•path = .npm-cache/_cacache/content-[redacted] kind = high_entropy_blob sizeBytes = 4317 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

•path = .npm-cache/_cacache/content-[redacted] kind = compressed_blob sizeBytes = 4317 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

.npm-cache/_cacache/content-v2/sha512/61/51/888f691a98b493c70e8db198e80717d2c2c9f4c9c75eb26738a7e436d5ce733ee675a65f8d7f155dc4fb5d1ef98d54e43a5d2606e0052dcadfc58bb0f5e9View on unpkg

test/integration/runtime/run.shView file

•path = test/integration/runtime/run.sh kind = payload_in_excluded_dir sizeBytes = 13543 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/integration/runtime/run.shView on unpkg

skills/web-console/public/markdown-it.min.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/web-console/public/markdown-it.min.jsView on unpkg