Loading npm security reports…

@codyswann/lisa@3.26.3: AI-agent control-surface risk | LPM Firewall

registry / @codyswann/lisa / 3.26.3

@codyswann/lisa@3.26.3

Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Dependency installation automatically applies Lisa to the host project and changes AI-agent control surfaces. It installs project-scoped Claude plugins, including third-party plugins, and writes a Codex overlay.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm package postinstall

Impact

Host project .claude and .codex agent behavior can be changed without a separate user command.

Mechanism

automatic host AI-agent configuration and plugin installation

Policy narrative

On installation, the postinstall shell script invokes the Lisa CLI on the consuming project, then uses the Claude CLI to install plugins at project scope. The package also reconciles host Codex agents, MCP configuration, skills, marketplace settings, and hooks. This is an unconsented install-time mutation of broad AI-agent control surfaces, not merely a package-local setup action.

Rationale

The lifecycle behavior is source-confirmed and automatically mutates the consuming project's Claude/Codex configuration, including third-party agent plugins. This meets the block boundary for unconsented postinstall mutation of a broad AI-agent control surface.

Evidence

package.jsonscripts/install-claude-plugins.shdist/codex/project-overlay.jsdist/codex/hooks-installer.js.claude/settings.json.claude/.lisa-plugins-synced.codex/config.toml.codex/hooks.json.codex/agents/lisa/

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harper-fabric/create-only/.github/workflows/deploy.ymlView file

75patternName = generic_password severity = medium line = 75 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L75

harper-fabric/copy-overwrite/eslint.config.tsView file

32L33: const require = createRequire(import.meta.url); L34: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

harper-fabric/copy-overwrite/eslint.config.tsView on unpkg · L32

all/copy-overwrite/scripts/lisa-work-item.mjsView file

6* Provider-neutral work-item binding and Git enforcement for Lisa projects. L7: * State is private to the current linked worktree; durable linkage lives in L8: * commit trailers, pull-request bodies, and the configured tracker. L9: */ L10: import { spawnSync } from "node:child_process"; L11: import { ... L79: * or wave through an item that genuinely is not committable. L80: * @param {{status: number|null, error?: Error, stderr?: string}} result Spawn result. L81: * @param {string} ref Work item reference. ... L146: const CHILD_TIMEOUT_MS = Number( L147: process.env.LISA_WORK_ITEM_TIMEOUT_MS || 30_000 L148: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

all/copy-overwrite/scripts/lisa-work-item.mjsView on unpkg · L6

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 5104 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 7759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

dist/utils/postinstall-trampoline.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.11.1 matchedPath = dist/utils/postinstall-trampoline.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/postinstall-trampoline.jsView on unpkg

dist/cli/setup-project.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.11.1 matchedPath = dist/cli/setup-project.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup-project.jsView on unpkg

dist/cli/ui-automations-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.11.1 matchedPath = dist/cli/ui-automations-adapters.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-automations-adapters.jsView on unpkg

dist/cli/ui-observability-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.11.1 matchedPath = dist/cli/ui-observability-checks.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-observability-checks.jsView on unpkg

dist/cli/update-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.11.1 matchedPath = dist/cli/update-cmd.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/update-cmd.jsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14