Loading npm security reports…

@cxtms/cx-schema@1.9.254: AI-agent control-surface risk | LPM Firewall

registry / @cxtms/cx-schema / 1.9.254

@cxtms/cx-schema@1.9.254

Schema validation package for CXTMS YAML modules

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On install, postinstall.js locates a consumer project and copies Claude Code skills into that project's .claude/skills directories without an explicit setup command. Those skills can then be loaded by Claude Code in the consuming repo.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of @cxtms/cx-schema when npm_package_name is unset or is not @cxtms/cx-schema

Impact

Unconsented project-level Claude Code skill installation and replacement in the consuming repository

Mechanism

postinstall copy of Claude Code skills into a consumer .claude/skills tree

Policy narrative

Installing this package runs scripts/postinstall.js. That script walks up from the install working directory until it finds a package.json not named @cxtms/cx-schema, then copies bundled skills into that project's .claude/skills folders, deleting any existing copies, and also writes .cx-schema files. Claude Code can load those dropped skills as project instructions without the user running a setup command. CLAUDE.md rewriting is in the same file but currently commented out. A name check skips the work when npm_package_name is this package, but main() still runs when that variable is missing.

AI rationale

The postinstall hook copies Claude Code skills into a consumer project's .claude/skills directory without an explicit setup command, which is unconsented mutation of a foreign AI-agent config location. That install-time write is enough to block even though the rest of the package is a YAML schema validator and CLAUDE.md setup is currently disabled.

Evidence

package.jsonscripts/postinstall.js.claude/skills/cxtms-developer

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62

Source & flagged code

11 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "@cxtms/cx-schema",

3 "version": "1.9.254",

4 "description": "Schema validation package for CXTMS YAML modules",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cxtms": "dist/cli.js",

9 "cx-cli": "dist/cli.js"

10 },

11 "scripts": {

12 "build": "tsc",

13 "prepare": "npm run build",

14 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "test": "vitest run"

16 },

17 "keywords": [

18 "schema",

19 "validation",

20 "yaml",

21 "tms",

22 "cxtms",

23 "module"

24 ],

25 "author": "CXTMS",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/cargoxplorer/cx-schema.git"

30 },

31 "files": [

32 "dist",

33 "schemas",

34 "scripts",

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47

dist/cli.jsView file

Lines 1507-1565javascript

1507 }

1508 // Remove deprecated skills if they exist

1509 const deprecatedSkills = ['cx-build', 'cx-core', 'cx-module', 'cx-workflow'];

1510 for (const oldSkill

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

3/**

4 * Postinstall script to create .cx-schema folder in the project root

5 */

6

7const fs = require(

templates/workflow-ftp-tracking.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47