registry / AI-agent control-surface risk / @coaligne/cli
@coaligne/cli
This report shows the evidence for @coaligne/cli@0.0.5, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource confirms the scanner finding: this is an unconsented postinstall chain that modifies multiple foreign AI-agent configurations and establishes persistence. That meets the firewall block boundary regardless of the package's stated collaboration purpose.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Automatic npm postinstall for @coaligne/cli@0.0.5.
Impact
Adds a remote MCP endpoint and bundled skills to agent clients; persistence can later synchronize configured project directories.
Mechanism
Install-time AI-agent configuration writes and launchd persistence.
Policy narrative
Installing the package automatically runs its CLI. That lifecycle chain installs bundled skills across several agent products, configures a coAligne remote MCP server in their user-level configuration, and on macOS creates a KeepAlive LaunchAgent that runs the CLI daemon. These are broad foreign AI-agent control-surface mutations performed without a user-invoked setup command.
AI rationale
Source confirms the scanner finding: this is an unconsented postinstall chain that modifies multiple foreign AI-agent configurations and establishes persistence. That meets the firewall block boundary regardless of the package's stated collaboration purpose.
Evidence
package.jsondist/chunk-Y26Y325W.jsdist/chunk-2FTAEUOQ.jsdist/chunk-BDZMRU7C.js~/.agents/skills/coaligne-workflow~/.gemini/config/skills/coaligne-workflow~/.claude/skills/coaligne-workflow~/.workbuddy/skills/coaligne-workflow~/.codex/config.toml~/.gemini/config/mcp_config.json~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json~/.workbuddy/mcp.json~/Library/LaunchAgents/com.coaligne.watch.plist
Network endpoints1
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json postinstall silently invokes daemon, skill, and MCP installation.
- dist/chunk-Y26Y325W.js installs bundled skills into Codex, Gemini, Claude, and WorkBuddy directories.
- dist/chunk-2FTAEUOQ.js writes a coAligne MCP server into five agent configuration files.
- dist/chunk-BDZMRU7C.js installs a persistent macOS LaunchAgent with KeepAlive.
- MCP configuration targets https://app.coaligne.com/mcp and can retain an access token in config.
Evidence against
- No eval, VM, dynamic remote-code loader, or credential-harvesting routine found.
- Cloud sync excludes common secret-file patterns by default.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
UrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./dist/index.js daemon install --quiet && node ./dist/index.js skill install-all --quiet && node ./dist/index.js mcp install --quiet || true
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./dist/index.js daemon install --quiet && node ./dist/index.js skill install-all --quiet && node ./dist/index.js mcp install --quiet || true
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/chunk-BDZMRU7C.jsView file
7Trigger-reachable persistence chain: scripts.postinstall -> dist/index.js -> dist/chunk-BDZMRU7C.js
L7: // src/commands/daemon.ts
L8: import { spawnSync } from "child_process";
L9: import { promises as fs9 } from "fs";
...
L131: }
L132: function localProjectsPath(workDir = process.cwd()) {
L133: return path2.join(workDir, ".coaligne", "projects.json");
...
L137: const raw = await fs2.readFile(localProjectsPath(workDir), "utf-8");
L138: const parsed = JSON.parse(raw);
L139: return Array.isArray(parsed.projects) ? dedupeProjects(parsed.projects) : [];
...
L319: };
L320: const res = await fetch(url, {
L321: method: "POST",
Findings
1 Critical2 High6 Medium4 Low
CriticalAi Agent Control Hijackdist/chunk-2FTAEUOQ.js
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencedist/chunk-BDZMRU7C.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/chunk-BDZMRU7C.js
MediumShips Build Helperdist/skills/codex-plugin/skills/coaligne/scripts/bind_project.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @coaligne/cli@0.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing @coaligne/cli@0.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.