Loading npm security reports…

@coaligne/cli@0.0.5: AI-agent control-surface risk | LPM Firewall

registry / @coaligne/cli / 0.0.5

@coaligne/cli@0.0.5

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall mutates multiple third-party AI-agent control surfaces without an explicit user command. On macOS it also installs and starts a persistent sync LaunchAgent.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Automatic npm postinstall for @coaligne/cli@0.0.5.

Impact

Adds a remote MCP endpoint and bundled skills to agent clients; persistence can later synchronize configured project directories.

Mechanism

Install-time AI-agent configuration writes and launchd persistence.

Policy narrative

Installing the package automatically runs its CLI. That lifecycle chain installs bundled skills across several agent products, configures a coAligne remote MCP server in their user-level configuration, and on macOS creates a KeepAlive LaunchAgent that runs the CLI daemon. These are broad foreign AI-agent control-surface mutations performed without a user-invoked setup command.

Rationale

Source confirms the scanner finding: this is an unconsented postinstall chain that modifies multiple foreign AI-agent configurations and establishes persistence. That meets the firewall block boundary regardless of the package's stated collaboration purpose.

Evidence

package.jsondist/chunk-Y26Y325W.jsdist/chunk-2FTAEUOQ.jsdist/chunk-BDZMRU7C.js~/.agents/skills/coaligne-workflow~/.gemini/config/skills/coaligne-workflow~/.claude/skills/coaligne-workflow~/.workbuddy/skills/coaligne-workflow~/.codex/config.toml

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/index.js daemon install --quiet && node ./dist/index.js skill install-all --quiet && node ./dist/index.js mcp install --quiet || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/index.js daemon install --quiet && node ./dist/index.js skill install-all --quiet && node ./dist/index.js mcp install --quiet || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-BDZMRU7C.jsView file

7Trigger-reachable persistence chain: scripts.postinstall -> dist/index.js -> dist/chunk-BDZMRU7C.js L7: // src/commands/daemon.ts L8: import { spawnSync } from "child_process"; L9: import { promises as fs9 } from "fs"; ... L131: } L132: function localProjectsPath(workDir = process.cwd()) { L133: return path2.join(workDir, ".coaligne", "projects.json"); ... L137: const raw = await fs2.readFile(localProjectsPath(workDir), "utf-8"); L138: const parsed = JSON.parse(raw); L139: return Array.isArray(parsed.projects) ? dedupeProjects(parsed.projects) : []; ... L319: }; L320: const res = await fetch(url, { L321: method: "POST",

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/chunk-BDZMRU7C.jsView on unpkg · L7

7// src/commands/daemon.ts L8: import { spawnSync } from "child_process"; L9: import { promises as fs9 } from "fs"; ... L131: } L132: function localProjectsPath(workDir = process.cwd()) { L133: return path2.join(workDir, ".coaligne", "projects.json"); ... L137: const raw = await fs2.readFile(localProjectsPath(workDir), "utf-8"); L138: const parsed = JSON.parse(raw); L139: return Array.isArray(parsed.projects) ? dedupeProjects(parsed.projects) : []; ... L319: }; L320: const res = await fetch(url, { L321: method: "POST",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-BDZMRU7C.jsView on unpkg · L7

dist/chunk-2FTAEUOQ.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L12: var MCP_SERVER_NAME = "coAligne"; L13: var CODEX_CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml"); L14: var GEMINI_CONFIG_PATH = path.join( ... L19: ); L20: var CLAUDE_CODE_CONFIG_PATH = path.join(os.homedir(), ".claude.json"); L21: var CLAUDE_DESKTOP_CONFIG_PATH = os.platform() === "darwin" ? path.join( ... L94: const config = JSON.parse(raw); L95: if (config.mcpServers && config.mcpServers[MCP_SERVER_NAME]) { L96: delete config.mcpServers[MCP_SERVER_NAME]; L97: await fs.writeFile( L98: filePath, ... L123: const config = JSON.parse(content); Write operation from dist/chunk-2FTAEUOQ.js: L12: var MCP_SERVER_NAME = "coAligne"; L13: var CODEX_CONFIG_PATH = path.join(os.homedir(), ".codex", "config.toml")

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/chunk-2FTAEUOQ.jsView on unpkg · L1

dist/skills/codex-plugin/skills/coaligne/scripts/bind_project.shView file

•path = dist/skills/codex-plugin/skills/coaligne/scripts/bind_project.sh kind = build_helper sizeBytes = 1882 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/skills/codex-plugin/skills/coaligne/scripts/bind_project.shView on unpkg