Loading npm security reports…

@codyswann/lisa@2.303.0: AI-agent control-surface risk | LPM Firewall

registry / @codyswann/lisa / 2.303.0

@codyswann/lisa@2.303.0

Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Automatic npm postinstall mutates the consuming project's Claude and Codex agent-control surfaces. It also removes user-wide Codex Lisa registrations without an explicit user command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm install of @codyswann/lisa

Impact

Host project agent settings, plugins, MCP configuration, skills, and user-wide Codex state can be changed during dependency installation.

Mechanism

postinstall-driven agent configuration, plugin installation, and Codex cleanup

Policy narrative

Installing the package automatically runs a shell script that applies Lisa to the consumer project, edits Claude settings, installs project-scoped Claude plugins, and removes user-wide Codex Lisa plugins and marketplace registrations. Its invoked Codex overlay writes project configuration, agents, skills, MCP entries, and marketplace data. These are unconsented install-time mutations of foreign AI-agent control surfaces.

Rationale

Source inspection confirms concrete postinstall mutation of host and user AI-agent configuration, exceeding a normal dependency install boundary. This meets the firewall policy for a publish block.

Evidence

package.jsonscripts/install-claude-plugins.shdist/codex/project-overlay.jsdist/codex/settings-installer.jsdist/codex/mcp-installer.js.claude/settings.json.claude/.lisa-plugins-synced.codex/config.toml

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harper-fabric/create-only/.github/workflows/deploy.ymlView file

72patternName = generic_password severity = medium line = 72 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L72

harper-fabric/copy-overwrite/eslint.config.tsView file

32L33: const require = createRequire(import.meta.url); L34: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

harper-fabric/copy-overwrite/eslint.config.tsView on unpkg · L32

all/copy-overwrite/scripts/lisa-work-item.mjsView file

3* Provider-neutral work-item binding and Git enforcement for Lisa projects. L4: * State is private to the current linked worktree; durable linkage lives in L5: * commit trailers, pull-request bodies, and the configured tracker. L6: */ L7: import { spawnSync } from "node:child_process"; L8: import { ... L31: const result = spawnSync(command, args, { L32: cwd: options.cwd ?? process.cwd(), L33: encoding: "utf8", L34: env: options.env ?? process.env, L35: input: options.input, ... L45: function git(args, options = {}) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

all/copy-overwrite/scripts/lisa-work-item.mjsView on unpkg · L3

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 4970 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 7759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

plugins/lisa-agy/scripts/plugin-sync-explain.mjsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@2.188.0 matchedPath = plugins/lisa-agy/scripts/plugin-sync-explain.mjs matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:2.188.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/lisa-agy/scripts/plugin-sync-explain.mjsView on unpkg

plugins/lisa-cursor/scripts/plugin-sync-explain.mjsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@2.188.0 matchedPath = plugins/lisa-agy/scripts/plugin-sync-explain.mjs matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:2.188.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/lisa-cursor/scripts/plugin-sync-explain.mjsView on unpkg

plugins/lisa-wiki-agy/scripts/ensure-wiki.mjsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@2.188.0 matchedPath = plugins/lisa-wiki-agy/scripts/ensure-wiki.mjs matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:2.188.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/lisa-wiki-agy/scripts/ensure-wiki.mjsView on unpkg

plugins/lisa-wiki-copilot/scripts/ensure-wiki.mjsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@2.188.0 matchedPath = plugins/lisa-wiki-agy/scripts/ensure-wiki.mjs matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:2.188.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/lisa-wiki-copilot/scripts/ensure-wiki.mjsView on unpkg

plugins/lisa-wiki-cursor/scripts/ensure-wiki.mjsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@2.188.0 matchedPath = plugins/lisa-wiki-agy/scripts/ensure-wiki.mjs matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:2.188.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/lisa-wiki-cursor/scripts/ensure-wiki.mjsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14