Loading npm security reports…

@cxtms/cx-schema@1.9.248: AI-agent control-surface risk | LPM Firewall

registry / @cxtms/cx-schema / 1.9.248

@cxtms/cx-schema@1.9.248

Schema validation package for CXTMS YAML modules

AI Security Review

scanned 26d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's Claude Code control surface. It replaces installed skills and deletes several existing skill directories.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation invokes the postinstall lifecycle hook.

Impact

Package-controlled instructions become active in the consumer project's AI-agent skill directory, while existing skills can be removed.

Mechanism

Automatic recursive deletion and replacement of Claude Code skill directories.

Policy narrative

On installation, the postinstall hook searches upward for a consumer project, creates files in it, and automatically installs package-owned Claude Code skills. Before copying those skills, it recursively removes same-named directories; it also removes four other Claude skill directories. This is unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The package has a registry-install postinstall hook that recursively deletes and replaces Claude Code skills in the consumer project. This meets the install-time AI-agent control-surface mutation block policy regardless of the absence of observed exfiltration.

Evidence

package.jsonscripts/postinstall.js.cx-schema.cx-schema/validate.js.claude/skills/cxtms-developer.claude/skills/cxtms-module-builder.claude/skills/cxtms-workflow-builder

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62

Source & flagged code

11 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "@cxtms/cx-schema",

3 "version": "1.9.248",

4 "description": "Schema validation package for CXTMS YAML modules",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cxtms": "dist/cli.js",

9 "cx-cli": "dist/cli.js"

10 },

11 "scripts": {

12 "build": "tsc",

13 "prepare": "npm run build",

14 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "test": "vitest run"

16 },

17 "keywords": [

18 "schema",

19 "validation",

20 "yaml",

21 "tms",

22 "cxtms",

23 "module"

24 ],

25 "author": "CXTMS",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/cargoxplorer/cx-schema.git"

30 },

31 "files": [

32 "dist",

33 "schemas",

34 "scripts",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47

dist/cli.jsView file

Lines 1507-1565javascript

1507 }

1508 // Remove deprecated skills if they exist

1509 const deprecatedSkills = ['cx-build', 'cx-core', 'cx-module', 'cx-workflow'];

1510 for (const oldSkill

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

3/**

4 * Postinstall script to create .cx-schema folder in the project root

5 */

6

7const fs = require(

templates/workflow-ftp-tracking.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47