Loading npm security reports…

@ciandt-flow/flow-ai-obs@0.13.0: AI-agent control-surface risk | LPM Firewall

registry / @ciandt-flow/flow-ai-obs / 0.13.0

@ciandt-flow/flow-ai-obs@0.13.0

Claude Code hooks for Langfuse OTLP tracing — cross-platform

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation silently alters the user's Claude Code hook configuration. Subsequent Claude Code events invoke this package, which collects trace content and posts it to the Flow tracing gateway.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs postinstall; later Claude Code prompt, tool, and stop events trigger the installed hooks.

Impact

User prompts, tool inputs and outputs, and assistant trace output can be transmitted without an explicit setup command.

Mechanism

Automatic Claude hook persistence followed by trace collection and HTTPS posting.

Policy narrative

On npm installation, postinstall launches the setup binary. That binary creates or rewrites the user's Claude Code settings and registers commands for prompt, tool, and stop hooks without requiring an explicit user setup command. When Claude Code fires those hooks, the CLI records prompt and tool trace fields, including tool outputs and assistant output, and posts the serialized trace to the Flow gateway. This is an unconsented install-time mutation of a foreign AI-agent control surface that enables ongoing collection.

Rationale

The automatic postinstall-to-Claude-hook chain is concrete, persistent, and reaches network transmission of captured AI interaction data. It meets the install-control-surface blocking policy.

Evidence

package.jsondist/setup.jsdist/cli.js~/.claude/settings.json~/.claude/settings.json.bkp~/.claude/settings.json.lock

Network endpoints1

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1'use strict';var child_process=require('child_process'),util=require('util'),h=require('fs'),G=require('path'),st=require('os'),cr=require('https'),lr=require('http'),crypto=requir... L2: `;try{h.writeFileSync(ar,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1'use strict';var child_process=require('child_process'),util=require('util'),h=require('fs'),G=require('path'),st=require('os'),cr=require('https'),lr=require('http'),crypto=requir... L2: `;try{h.writeFileSync(ar,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1'use strict';var child_process=require('child_process'),util=require('util'),h=require('fs'),G=require('path'),st=require('os'),cr=require('https'),lr=require('http'),crypto=requir... L2: `;try{h.writeFileSync(ar,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.js L1: 'use strict';var child_process=require('child_process'),util=require('util'),h=require('fs'),G=require('path'),st=require('os'),cr=require('https'),lr=require('http'),crypto=requir... L2: `;try{h.writeFileSync(ar,e,{flag:"a"});}catch(r){process.stderr.write(`[flow-obs debug ERROR] ${r.message}

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L1

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: 'use strict';var Me=require('readline/promises'),_s=require('https'),O=require('fs'),wt=require('os'),$t=require('path'),child_process=require('child_process'),Ms=require('http'),u... `);}catch(o){throw r.close(),o}if(r.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function De(t,e){let r=Me__namespace.createInte... `);let r=child_process.spawn("npm",["install","-g",`${e}@${t}`],{detached:true,stdio:"ignore",shell:process.platform==="win32",windowsHide:true});r.on("error",()=>{}),r.unref();}as... `);}r();}}n.on("close",(o,a)=>i(o===0,a??void 0)),n.on("error",o=>i(false,o.co

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

1#!/usr/bin/env node L2: 'use strict';var Me=require('readline/promises'),_s=require('https'),O=require('fs'),wt=require('os'),$t=require('path'),child_process=require('child_process'),Ms=require('http'),u... L3: `);}catch(o){throw r.close(),o}if(r.close(),e!==void 0)return e;throw new Error("Too many invalid attempts for yes/no prompt")}async function De(t,e){let r=Me__namespace.createInte... L4: \u256D${o}\u256E ... L11: L12: `);let r=child_process.spawn("npm",["install","-g",`${e}@${t}`],{detached:true,stdio:"ignore",shell:process.platform==="win32",windowsHide:true});r.on("error",()=>{}),r.unref();}as... L13: \u256D${d}\u256E ... L30: `)+` L31: `),1}var Te=h(()=>{"use strict";pt();});function Mr(){if(process.platform==="linux"&&process.getuid?.()===0&&process.env.SUDO_USER){let e=c

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

dist/index.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.js#virtual:string-array:round1View on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 1-38json

1{

2 "name": "@ciandt-flow/flow-ai-obs",

3 "version": "0.13.0",

4 "description": "Claude Code hooks for Langfuse OTLP tracing — cross-platform",

5 "main": "dist/index.js",

6 "bin": {

7 "flow-ai-obs": "dist/cli.js",

8 "flow-ai-obs-setup": "dist/setup.js"

9 },

10 "scripts": {

11 "build": "tsup",

12 "test": "jest",

13 "typecheck": "tsc --noEmit",

14 "lint": "eslint src bin scripts",

15 "format": "prettier --write \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.ts\"",

16 "format:check": "prettier --check \"src/**/*.ts\" \"bin/**/*.ts\" \"scripts/**/*.ts\"",

17 "security-scan": "trufflehog filesystem src/ --fail --no-update --exclude-paths .trufflehogignore",

18 "postinstall": "node -e \"require('fs').existsSync('dist/setup.js') && require('child_process').execFileSync(process.execPath, ['dist/setup.js'], {stdio:'inherit'})\"",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepublishOnly": "npm run security-scan && npm run build",

20 "release:npm": "changeset publish",

21 "changeset": "changeset",

22 "version-packages": "changeset version",

23 "install:hooks": "node dist/cli.js install",

24 "auth:login": "node dist/cli.js auth login",

25 "auth:logout": "node dist/cli.js auth logout",

26 "auth:status": "node dist/cli.js auth status",

27 "smoke": "bash scripts/smoke-test.sh",

28 "smoke:debug": "bash scripts/smoke-test.sh --debug",

29 "smoke:send": "bash scripts/smoke-test.sh --send --allow-http --debug",

30 "regression": "jest --config jest.regression.config.js --forceExit",

31 "regression:update": "UPDATE_GOLDEN=1 jest --config jest.regression.config.js --forceExit"

32 },

33 "files": [

34 "dist/",

35 "README.md",

36 "LICENSE.md"

37 ],

38 "keywords": [

dist/index.jsView file

Lines 1-21javascript

1'use strict';var child_process=require('child_process'),util=require('util'),h=require('fs'),G=require('path'),st=require('os'

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2'use strict';var Me=require('readline/promises'),_s=require('https'),O=require('fs'),wt=require('os'),$t=require

dist/index.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index.js#virtual:string-array:round1View on unpkg