Loading npm security reports…

@cocoar/signalarrr@5.0.0: AI-agent control-surface risk | LPM Firewall

registry / @cocoar/signalarrr / 5.0.0

@cocoar/signalarrr@5.0.0

TypeScript client for SignalARRR — type-safe RPC over SignalR

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm installation, the package attempts to populate AI-agent-related directories in the consuming project. It targets existing .claude and .github directories and overwrites the signalarrr skill subtree.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Automatic npm postinstall in a consuming project.

Impact

Package installation can alter agent-visible project instructions or assets without an explicit setup command.

Mechanism

Install-time recursive copying into consumer AI-agent control directories.

Policy narrative

Installing the package runs scripts/postinstall.cjs. When the consumer project already has .claude or .github, the hook creates skills/signalarrr and references subdirectories and recursively copies package assets there with force enabled. This is an unconsented install-time mutation of broad AI-agent control surfaces. The asset guard makes this extracted snapshot inert, but the lifecycle source implements the mutation for releases that contain the declared assets.

AI rationale

The postinstall hook concretely mutates consumer .claude and .github agent-control directories without an explicit user command. That meets the install-time AI-agent control-surface abuse boundary despite the missing assets in this snapshot.

Evidence

package.jsonscripts/postinstall.cjs.claude/skills/signalarrr.github/skills/signalarrr.claude/skills/signalarrr/references.github/skills/signalarrr/references

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

15"scripts": { "build": "tsup", "dev": "tsup --watch", "test": "vitest run", "test:watch": "vitest", "prepack": "node scripts/copy-assets.cjs", "postinstall": "node scripts/postinstall.cjs" }

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L15

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.cjsView file

4* Mirrors the MSBuild buildTransitive targets behaviour: L5: * - Only copies if .claude / .github already exists (no folder pollution) L6: * - Copies SKILL.md → {agentDir}/skills/signalarrr/ ... L8: */ L9: const { existsSync, mkdirSync, cpSync } = require('node:fs'); L10: const { join } = require('node:path'); ... L31: L32: mkdirSync(skillsDst, { recursive: true }); L33: mkdirSync(refsDst, { recursive: true }); L34: L35: cpSync(skillsSrc, skillsDst, { recursive: true, force: true }); L36: cpSync(docsSrc, refsDst, { recursive: true, force: true });

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.cjsView on unpkg · L4

26function copySkills(agentDir) { if (!existsSync(agentDir)) return; const skillsDst = join(agentDir, 'skills', 'signalarrr'); const refsDst = join(agentDir, 'skills', 'signalarrr', 'references'); mkdirSync(skillsDst, { recursive: true }); mkdirSync(refsDst, { recursive: true }); cpSync(skillsSrc, skillsDst, { recursive: true, force: true }); cpSync(docsSrc, refsDst, { recursive: true, force: true });

High

Ai Review Evidence

The hook writes package-provided skill content into existing .claude and .github directories in the consuming project.

scripts/postinstall.cjsView on unpkg · L26

41copySkills(join(projectRoot, '.claude')); copySkills(join(projectRoot, '.github'));

High

Ai Review Evidence

The hook writes package-provided skill content into existing .claude and .github directories in the consuming project.

scripts/postinstall.cjsView on unpkg · L41