Loading npm security reports…

@codyswann/lisa@3.48.2: AI-agent control-surface risk | LPM Firewall

registry / @codyswann/lisa / 3.48.2

@codyswann/lisa@3.48.2

Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a noninteractive host-project reconciler. It installs project-scoped Claude plugins and modifies Codex project configuration, agents, MCP, skills, and marketplace surfaces.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation outside CI

Impact

A dependency install can alter the host project's AI-agent behavior and install third-party plugins without an explicit setup command.

Mechanism

unconsented lifecycle-driven AI-agent configuration and plugin installation

Policy narrative

The npm postinstall launches Lisa with --yes against the consuming project. The lifecycle script then installs Lisa, official, and third-party Claude plugins at project scope, while the reconciler writes project-level Codex agents, MCP configuration, skills, marketplace entries, and enables hooks. These are broad AI-agent control surfaces changed merely by installing a dependency, rather than by an explicit user setup command.

Rationale

This is concrete unconsented postinstall mutation of broad host AI-agent control surfaces, including third-party plugin installation. No exfiltration was found, but the install-time control-surface behavior meets the blocking boundary.

Evidence

package.jsonscripts/install-claude-plugins.shdist/codex/project-overlay.jsdist/codex/settings-installer.js<host-project>/.claude/settings.json<host-project>/.claude/.lisa-plugins-synced<host-project>/.codex/config.toml

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harper-fabric/create-only/.github/workflows/deploy.ymlView file

75patternName = generic_password severity = medium line = 75 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L75

harper-fabric/copy-overwrite/eslint.config.tsView file

32L33: const require = createRequire(import.meta.url); L34: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

harper-fabric/copy-overwrite/eslint.config.tsView on unpkg · L32

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 5104 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 7759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

dist/utils/postinstall-trampoline.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/utils/postinstall-trampoline.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/postinstall-trampoline.jsView on unpkg

dist/cli/setup-project.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/setup-project.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup-project.jsView on unpkg

dist/cli/ui-automations-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/ui-automations-adapters.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-automations-adapters.jsView on unpkg

dist/cli/ui-observability-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/ui-observability-checks.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-observability-checks.jsView on unpkg

dist/cli/update-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/update-cmd.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/update-cmd.jsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14

Source & flagged code

16 flagged

package.jsonView file

Lines 1-27json

1{

2 "scripts": {

3 "build": "bun run build:dist && bun run build:plugins",

4 "build:dist": "node scripts/clean-dist.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",

5 "test:integration": "vitest run tests/integration",

6 "test:integration:push": "vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts'",

7 "postinstall": "bash ./scripts/install-claude-plugins.sh || true; [ -d dist/configs ] || tsc || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 "pretest": "[ -d dist/configs ] || bun run build",

9 "test": "vitest run",

10 "test:unit": "vitest run --exclude='**/integration/**'",

11 "test:cov": "vitest run --coverage",

12 "test:cov:unit": "vitest run --coverage --exclude='**/integration/**'",

13 "pretest:mutation": "[ -d dist/configs ] || bun run build",

14 "test:mutation": "node scripts/lisa-mutation.mjs",

15 "test:mutation:full": "stryker run",

16 "lint": "oxlint --disable-nested-config && eslint . --quiet",

17 "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",

18 "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",

19 "typecheck": "tsc --noEmit",

20 "format:check": "prettier --check .",

21 "format": "prettier --check . --write",

22 "knip:check": "knip",

23 "knip:fix": "knip --fix",

24 "sg:scan": "ast-grep scan",

25 "sg:test": "ast-grep test",

26 "build:plugins": "bash scripts/build-plugins.sh",

27 "prepare": "node -e \"if (process.env.INIT_CWD?.includes('.serverless')) process.exit(0); process.exit(1);\" || husky install || true",

harper-fabric/create-only/.github/workflows/deploy.ymlView file

75patternName = generic_password severity = medium line = 75 matchedText = password...}" \

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L75

harper-fabric/copy-overwrite/eslint.config.tsView file

Lines 12-52typescript

12 * merged into the ignore list so host customizations survive the

13 * copy-overwrite of eslint.ignore.config.json on each Lisa update.

14 *

15 * @see https://eslint.org/docs/latest/use/configure/configuration-files-new

16 *

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 5104 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 7759 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

dist/utils/postinstall-trampoline.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/utils/postinstall-trampoline.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/postinstall-trampoline.jsView on unpkg

dist/cli/setup-project.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/setup-project.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup-project.jsView on unpkg

dist/cli/ui-automations-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/ui-automations-adapters.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-automations-adapters.jsView on unpkg

dist/cli/ui-observability-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/ui-observability-checks.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-observability-checks.jsView on unpkg

dist/cli/update-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@3.41.0 matchedPath = dist/cli/update-cmd.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:3.41.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/update-cmd.jsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

9

10const PLACEHOLDERS

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

9

10const PLACEHOLDERS

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

9

10const PLACEHOLDERS

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Deterministic wiki source safety helpers.

4 *

5 * This module intentionally uses only Node built-ins and pure string scanning so

6 * downstream wiki connectors can run the same redaction pass before persisting

7 * reader-safe source notes.

8 */

9

10const PLACEHOLDERS

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14 matchedText = password...D]",

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14