Loading npm security reports…

@c4a/context-cli@0.7.35: AI-agent control-surface risk | LPM Firewall

registry / @c4a/context-cli / 0.7.35

@c4a/context-cli@0.7.35

Local runtime and Agent integration for traceable knowledge production

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install runs postinstall, which launches plugin install for Claude, Codex, and Cursor. That command writes user-level agent plugin configuration and skill directories without a separate plugin command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall when npm_config_global is set or CONTEXT_CLI_AUTO_PLUGIN_INSTALL is 1.

Impact

Foreign user agent control files for Claude, Codex, and Cursor are created or rewritten as a side effect of installing the package globally.

Mechanism

scripts/postinstall.mjs spawnSyncs the bundled cli.js with plugin install. The default agent is all, which installs a user-scoped Claude plugin, enables a Codex plugin in config.toml, copies a Cursor user plugin, and materializes provider skills under home agent directories.

Policy narrative

On a global npm install, postinstall starts the bundled CLI with plugin install and no agent flag. The command treats the target as all and registers this package in the user Claude plugin scope, enables it in the Codex config file, copies a Cursor user plugin, and writes skills under the home agent skill directories. Local and CI installs are skipped, but the global path does not require a separate plugin command. Installing the package therefore mutates several foreign agent control surfaces.

AI rationale

The postinstall hook automatically runs a broad plugin install into Claude, Codex, and Cursor user configuration during a global package install. That is unconsented lifecycle mutation of foreign agent control surfaces, so the package should be blocked.

Evidence

package.jsonscripts/postinstall.mjscli.js.claudeplugins/cache.claude/skills

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

7L8: import { spawnSync } from "node:child_process"; L9: import { existsSync, realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L7

42"Claude plugin installed without a global context CLI. Install it with:", L43: ` npm install -g @c4a/context-cli@${version}`, L44: ], ... L49: const lookup = process.platform === "win32" L50: ? spawnSync("where", ["context"], { stdio: "ignore" }) L51: : spawnSync("sh", ["-c", "command -v context"], { stdio: "ignore" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L42

parserEntryWorker.jsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31: var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

parserEntryWorker.jsView on unpkg · L29

cli.jsView file

35class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

cli.jsView on unpkg · L35

•Trigger-reachable chain: manifest.main -> cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.jsView on unpkg

35Cross-file remote execution chain: cli.js spawns browser/diagrams.js; helper contains network access plus dynamic code execution. L35: class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

browser/diagrams.jsView file

•path = browser/diagrams.js kind = oversized_source_file sizeBytes = 4207607 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

browser/diagrams.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 41-64json

41 "handlebars": "^4.7.8",

42 "ink": "^5.0.0",

43 "jiti": "^2.7.0",

44 "mdast-util-to-string": "^4.0.0",

45 "mermaid": "11.12.0",

46 "react": "^18.3.1",

47 "remark-gfm": "^4.0.1",

48 "remark-mdx": "^3.1.1",

49 "remark-parse": "^11.0.0",

50 "remark-stringify": "^11.0.0",

51 "sharp": "^0.35.3",

52 "typescript": "^5.5.4",

53 "unified": "^11.0.5",

54 "vitepress": "1.6.4",

55 "web-tree-sitter": "^0.20.8",

56 "yaml": "^2.5.1",

57 "zod": "^3.23.8"

58 },

59 "main": "./cli.js",

60 "scripts": {

61 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 }

63}

64

scripts/postinstall.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2/**

3 * Best-effort global agent plugin refresh after a global context-cli install.

4 * Local project dependencies and CI installs must not mutate user-level agent

5 * configuration. Link development performs the same refresh in cliLink.ts.

6 */

7

8import { spawnSync } from "node:child_process";

9import { existsSync, realpathSync }

parserEntryWorker.jsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31: var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

parserEntryWorker.jsView on unpkg · L29

cli.jsView file

35class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

cli.jsView on unpkg · L35

•Trigger-reachable chain: manifest.main -> cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.jsView on unpkg

35Cross-file remote execution chain: cli.js spawns browser/diagrams.js; helper contains network access plus dynamic code execution. L35: class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

browser/diagrams.jsView file

•path = browser/diagrams.js kind = oversized_source_file sizeBytes = 4207607 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

browser/diagrams.jsView on unpkg