Loading npm security reports…

@codyswann/lisa@3.41.0: AI-agent control-surface risk | LPM Firewall

registry / @codyswann/lisa / 3.41.0

@codyswann/lisa@3.41.0

Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs an unprompted postinstall that mutates the host project's AI-agent setup. It installs project-scope Claude plugins, removes user-wide Codex Lisa registrations, and can re-run after the package manager exits.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm package installation

Impact

Unconsented mutation of Claude/Codex control surfaces and installation of additional agent plugins in the host project.

Mechanism

postinstall-driven AI-agent configuration, plugin, and template mutation

Policy narrative

On installation, the lifecycle hook runs a shell script that applies Lisa to the host project non-interactively, manipulates Claude project plugins, and removes Lisa registrations from the user's Codex configuration. It also updates the Lisa marketplace over the network and has code to detach a reconciliation process after the package manager exits. These are broad AI-agent control-surface changes without an explicit user command.

Rationale

The inspected postinstall behavior concretely mutates foreign host AI-agent configuration and installs plugins automatically. This exceeds a first-party, user-invoked setup flow.

Evidence

package.jsonscripts/install-claude-plugins.shdist/core/lisa.jsdist/codex/project-overlay.js$PROJECT_ROOT/.claude/settings.json$PROJECT_ROOT/package.json$HOME/.codex/.lisa-legacy-plugins-retired

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harper-fabric/create-only/.github/workflows/deploy.ymlView file

75patternName = generic_password severity = medium line = 75 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L75

harper-fabric/copy-overwrite/eslint.config.tsView file

32L33: const require = createRequire(import.meta.url); L34: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

harper-fabric/copy-overwrite/eslint.config.tsView on unpkg · L32

all/copy-overwrite/scripts/lisa-work-item.mjsView file

6* Provider-neutral work-item binding and Git enforcement for Lisa projects. L7: * State is private to the current linked worktree; durable linkage lives in L8: * commit trailers, pull-request bodies, and the configured tracker. L9: */ L10: import { spawnSync } from "node:child_process"; L11: import { ... L87: * or wave through an item that genuinely is not committable. L88: * @param {{status: number|null, error?: Error, stderr?: string}} result Spawn result. L89: * @param {string} ref Work item reference. ... L182: const CHILD_TIMEOUT_MS = Number( L183: process.env.LISA_WORK_ITEM_TIMEOUT_MS || 30_000 L184: );

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

all/copy-overwrite/scripts/lisa-work-item.mjsView on unpkg · L6

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 5104 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 7759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

dist/utils/postinstall-trampoline.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.26.3 matchedPath = dist/utils/postinstall-trampoline.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.26.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/postinstall-trampoline.jsView on unpkg

plugins/lisa-cursor/scripts/design-source-gate.mjsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.26.3 matchedPath = plugins/lisa-cursor/scripts/design-source-gate.mjs matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.26.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugins/lisa-cursor/scripts/design-source-gate.mjsView on unpkg

dist/cli/setup-project.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.26.3 matchedPath = dist/cli/setup-project.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.26.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup-project.jsView on unpkg

dist/cli/ui-automations-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.26.3 matchedPath = dist/cli/ui-automations-adapters.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.26.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-automations-adapters.jsView on unpkg

dist/cli/ui-observability-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.26.3 matchedPath = dist/cli/ui-observability-checks.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.26.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-observability-checks.jsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14