Loading npm security reports…

@cxtms/cx-schema@1.9.257: AI-agent control-surface risk | LPM Firewall

registry / @cxtms/cx-schema / 1.9.257

@cxtms/cx-schema@1.9.257

Schema validation package for CXTMS YAML modules

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing this package as a dependency runs postinstall, which writes Claude Code skills into the consumer project's .claude/skills folder without a separate user command. Those skills then sit on Claude Code's project control surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install of @cxtms/cx-schema as a dependency of another project.

Impact

Claude Code can load package-supplied skills in the consuming project without an explicit install-skills or setup command.

Mechanism

unconsented postinstall write into .claude/skills

Policy narrative

On npm install, postinstall.js finds a consuming project and copies cxtms-developer, cxtms-module-builder, and cxtms-workflow-builder into that project's .claude/skills directory, replacing existing copies and removing older skill names. That is an automatic write to Claude Code's project skill surface. A user who only added a schema validator never opted into agent skill installation. The CLI has an explicit install-skills command, but the same write already happens at install time.

AI rationale

postinstall mutates a foreign Claude Code skill directory in the consuming project without a user command, which is unconsented agent-control-surface hijack. Skill text looks product-related, but that does not make the automatic write consented.

Evidence

package.jsonscripts/postinstall.js.claude/skills/cxtms-developer.claude/skills/cxtms-module-builder.claude/skills/cxtms-workflow-builder

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

templates/workflow-ftp-edi.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/workflow-ftp-edi.yamlView on unpkg · L62

dist/cli.jsView file

1527console.log(chalk_1.default.bold.cyan('╚═══════════════════════════════════════════════════════════════════╝\n')); L1528: const { execSync } = require('child_process'); L1529: const legacyPkgPath = path.join(process.cwd(), 'node_modules', '@cxtms', 'cx-schema', 'package.json');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1527

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. st)) { fs.mkdirsync(dest, { recursive: true }); } const entries = fs.readdirsync(src, { withfiletypes: true }); for (const entry of entries) { const srcpath = path.join(src, entry.name); const destpath = path.join(dest, entry.name); if (entry.isdirectory()) { copydirectorysync(srcpath, destpath); } else { fs.copyfilesync(srcpath, destpath); } } } function runinstallskills() { console.log(chalk_1.default.bold.cyan('\n╔═══════════════════════════════════════════════════════════════════╗')); console.log(chalk_1.default.bold.cyan('║ install claude code skills

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cli.jsView on unpkg

1545try { L1546: execSync('npm install cxtms@latest', { L1547: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1545

scripts/postinstall.jsView file

1Install-time AI-agent control hijack evidence: L35: if (!fs.existsSync(dest)) { L36: fs.mkdirSync(dest, { recursive: true }); L37: } ... L48: } else { L49: fs.copyFileSync(srcPath, destPath); L50: } ... L103: const scriptPath = path.join(projectRoot, '.cx-schema', 'validate.js'); L104: fs.writeFileSync(scriptPath, scriptContent, 'utf-8'); L105: ... L172: function setupClaudeMd(projectRoot) { L173: const claudeMdPath = path.join(projectRoot, 'CLAUDE.md'); L174: const cxContent = generateClaudeMdContent(); Payload evidence from skills/cxtms-developer/SKILL.md: L1: --- L2: name: cxtms-developer

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

templates/workflow-ftp-tracking.yamlView file

62patternName = generic_password severity = medium line = 62

Medium

Secret Pattern

Hardcoded password in templates/workflow-ftp-tracking.yaml

templates/workflow-ftp-tracking.yamlView on unpkg · L62

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "@cxtms/cx-schema",

3 "version": "1.9.257",

4 "description": "Schema validation package for CXTMS YAML modules",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "cxtms": "dist/cli.js",

9 "cx-cli": "dist/cli.js"

10 },

11 "scripts": {

12 "build": "tsc",

13 "prepare": "npm run build",

14 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "test": "vitest run"

16 },

17 "keywords": [

18 "schema",

19 "validation",

20 "yaml",

21 "tms",

22 "cxtms",

23 "module"

24 ],

25 "author": "CXTMS",

26 "license": "MIT",

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/cargoxplorer/cx-schema.git"

30 },

31 "files": [

32 "dist",

33 "schemas",

34 "scripts",

templates/workflow-ftp-edi.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47

dist/cli.jsView file

Lines 1507-1565javascript

1507 }

1508 // Remove deprecated skills if they exist

1509 const deprecatedSkills = ['cx-build', 'cx-core', 'cx-module', 'cx-workflow'];

1510 for (const oldSkill

scripts/postinstall.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L1

3/**

4 * Postinstall script to create .cx-schema folder in the project root

5 */

6

7const fs = require(

templates/workflow-ftp-tracking.yamlView file

Lines 42-82yaml

42 - task: "Utilities/Log@1"

43 name: LogActivityCompleted

44 inputs:

45 message: "Activity FtpImport completed"

46 level: Information

47