Loading npm security reports…

@cartanova/qgrid-cli@2.7.0: AI-agent control-surface risk | LPM Firewall

registry / @cartanova/qgrid-cli / 2.7.0

@cartanova/qgrid-cli@2.7.0

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code mutates Codex and Claude Code skill control surfaces. It recursively removes existing qgrid skill directories and creates symlinks or copies package-controlled content.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall during local or global installation

Impact

Package-controlled instructions become active in project or user-wide AI-agent skill locations.

Mechanism

unconsented AI-agent skill installation and replacement

Policy narrative

npm automatically executes postinstall.mjs. For a local install it removes and replaces project .agents and .claude qgrid skill directories; for a global install it does the same in user-wide Codex and Claude Code skill directories. This is an unconsented install-time mutation of foreign AI-agent control surfaces, including recursive removal of pre-existing target content.

Rationale

Although the bundled skill is documented and appears qgrid-specific, the postinstall hook automatically replaces foreign project and user-wide agent skill locations. That concrete install-time control-surface mutation meets the block boundary.

Evidence

package.jsonpostinstall.mjsREADME.mdskills/qgrid/SKILL.mdskills/qgrid<project>/.agents/skills/qgrid<project>/.claude/skills/qgrid~/.codex/skills/qgrid~/.claude/skills/qgrid

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bundle/web-dist/server/assets/services.generated-D3Q3FYot.jsView file

18664try { L18665: new Function(""); L18666: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/services.generated-D3Q3FYot.jsView on unpkg · L18664

dist/cli.jsView file

300try { L301: const client = new (await (import("pg"))).default.Client({ L302: host: dbHost,

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L300

bundle/web-dist/server/entry-server.generated.jsView file

22if (!shouldRedactErrors(error)) return Promise.reject(error); L23: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L24: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L32: ...query.state, L33: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L34: }, ... L401: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L402: let promise = query.fetch(void 0, fetchOptions); L403: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1081: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L22

postinstall.mjsView file

54if (hasArg("--global") || isGlobalInstall) { L55: const codexHome = process.env.CODEX_HOME L56: ? path.resolve(process.env.CODEX_HOME) L57: : path.join(os.homedir(), ".codex"); L58: const claudeHome = process.env.CLAUDE_HOME L59: ? path.resolve(process.env.CLAUDE_HOME) L60: : path.join(os.homedir(), ".claude"); L61: return [ ... L77: label: "Codex", L78: target: path.join(projectRoot, ".agents", "skills", "qgrid"), L79: useSymlink: true, ... L82: label: "Claude Code",

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L54

bundle/dist/application/qgrid/tool-emulation.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundle/dist/application/qgrid/tool-emulation.jsView on unpkg

bundle/dist/utils/providers/openai/codex-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.6.10 matchedPath = [redacted]-worker.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/openai/codex-worker.jsView on unpkg

bundle/dist/utils/providers/anthropic/claude-session.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.6.10 matchedPath = [redacted]-session.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/anthropic/claude-session.jsView on unpkg

bundle/web-dist/server/assets/lazyRouteComponent-DOc8TV-P.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.6.10 matchedPath = bundle/web-[redacted]-Ws7I6fL-.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/web-dist/server/assets/lazyRouteComponent-DOc8TV-P.jsView on unpkg

bundle/web-dist/client/assets/services.generated-jGypfumC.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cartanova/qgrid-cli@2.6.11 matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.11 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bundle/web-dist/client/assets/services.generated-jGypfumC.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 38-60json

38 "fastify": "^4",

39 "ioredis": "^5.8.2",

40 "knex": "^3.2.9",

41 "pg": "^8.16.3",

42 "radashi": "^12.2.0",

43 "sonamu": "0.10.3",

44 "typescript": "6.0.3",

45 "zod": "^4.3.6"

46 },

47 "devDependencies": {

48 "@types/node": "25.0.7",

49 "@types/pg": "^8.20.0",

50 "tsdown": "^0.22.3"

51 },

52 "engines": {

53 "node": ">=20"

54 },

55 "scripts": {

56 "bundle": "cd ../api && pnpm build && cd ../cli && rm -rf bundle && mkdir -p bundle/public && touch bundle/.env && cp -r ../api/dist ./bundle/dist && cp -r ../api/web-dist ./bundle/web-dist && cp -r ../api/src ./bundle/src",

57 "build": "tsdown",

58 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L58

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L58

59 }

60}

bundle/web-dist/server/assets/services.generated-D3Q3FYot.jsView file

18664try { L18665: new Function(""); L18666: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/services.generated-D3Q3FYot.jsView on unpkg · L18664

dist/cli.jsView file

Lines 280-320javascript

280 applyQgridDatabaseEnv(process.env);

281 process.env.PORT = serverPort;

282 process.env.NODE_ENV ||= "production";

283 if (process.env.NODE_ENV !== "staging"

bundle/web-dist/server/entry-server.generated.jsView file

22if (!shouldRedactErrors(error)) return Promise.reject(error); L23: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L24: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L32: ...query.state, L33: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L34: }, ... L401: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L402: let promise = query.fetch(void 0, fetchOptions); L403: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1081: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L22

postinstall.mjsView file

Lines 34-74javascript

34}

35

36function defaultProjectRoot() {

37 if (process.env.QGRID_SKILLS_CWD) return findProjectRoot(process.env.QGRID_SKILLS_CWD);

38 if (process.env.INIT_CWD) return

bundle/dist/application/qgrid/tool-emulation.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundle/dist/application/qgrid/tool-emulation.jsView on unpkg

bundle/dist/utils/providers/openai/codex-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.6.10 matchedPath = [redacted]-worker.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/openai/codex-worker.jsView on unpkg

bundle/dist/utils/providers/anthropic/claude-session.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.6.10 matchedPath = [redacted]-session.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/anthropic/claude-session.jsView on unpkg

bundle/web-dist/server/assets/lazyRouteComponent-DOc8TV-P.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.6.10 matchedPath = bundle/web-[redacted]-Ws7I6fL-.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/web-dist/server/assets/lazyRouteComponent-DOc8TV-P.jsView on unpkg

bundle/web-dist/client/assets/services.generated-jGypfumC.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cartanova/qgrid-cli@2.6.11 matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.6.11 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bundle/web-dist/client/assets/services.generated-jGypfumC.jsView on unpkg