@dev-mainsequence/command-center-sdk@0.1.12: Suspicious npm | LPM Firewall

Loading npm security reports…

@dev-mainsequence/command-center-sdk@0.1.12: Suspicious npm | LPM Firewall

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./cli/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./cli/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

151"scripts": { "build": "node ../scripts/clean-sdk-dist.mjs && tsc -p tsconfig.json", "size:check": "node ../scripts/check-package-size.mjs dist/index.js 10000 && node ../scripts/check-package-size.mjs dist/views/ResourceListPage.js 50000 && node ../scripts/check-package-size.mjs dist/views/ResourceSearch.js 25000 && node ../scripts/check-package-size.mjs dist/views/ResourcePagination.js 25000", "check": "npm run theme:audit && tsc -p tsconfig.json --noEmit", "theme:audit": "node cli/command-center-sdk.mjs theme audit --path styles.css", "test": "vitest run && node --test

Medium

Suspicious Lifecycle Evidence

postinstall executes cli/postinstall.mjs.

package.jsonView on unpkg · L151

cli/install-agent-skills.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L338: resolvedProjectDir, L339: ".agents", L340: "skills", ... L391: const skillsParent = dirname(destinationRoot); L392: await mkdir(skillsParent, { recursive: true }); L393: const stageRoot = await mkdtemp(join(skillsParent, ".command-center-stage-")); ... L402: const staged = join(stageRoot, ...item.relativePath.split("/")); L403: await mkdir(dirname(staged), { recursive: true }); L404: await cp(item.source, staged, { L405: recursive: true, ... L411: L412: await mkdir(destinationRoot, { recursive: true }); Write operation from cli/install-agent-skills.mjs: L338: resolvedProjectDir, L339: ".agents", L340: "skills", ... L391: const skillsParent = dirname(destinationRoot); L392: await mkdir(skillsParent, { recursive: t

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/install-agent-skills.mjsView on unpkg · L1

Source & flagged code

4 flagged

package.jsonView file

Lines 131-180json

131 "types": "./dist/theme/presets/index.d.ts",

132 "import": "./dist/theme/presets/index.js"

133 },

134 "./theme/ag-grid.css": "./theme/ag-grid.css",

135 "./theme/fonts.css": "./theme/fonts.css",

136 "./theme/markdown.css": "./theme/markdown.css",

137 "./theme/react-flow.css": "./theme/react-flow.css",

138 "./theme/react-grid-layout.css": "./theme/react-grid-layout.css",

139 "./theme/styles.css": "./theme/styles.css",

140 "./theme/tailwind.css": "./theme/tailwind.css",

141 "./theme/utilities.css": "./theme/utilities.css",

142 "./widget/built-ins.css": "./widget/built-ins.css",

143 "./tailwind.css": "./theme/tailwind.css",

144 "./styles.css": "./styles.css",

145 "./package.json": "./package.json"

146 },

147 "publishConfig": {

148 "access": "public",

149 "registry": "https://registry.npmjs.org/"

150 },

151 "scripts": {

152 "build": "node ../scripts/clean-sdk-dist.mjs && tsc -p tsconfig.json",

153 "size:check": "node ../scripts/check-package-size.mjs dist/index.js 10000 && node ../scripts/check-package-size.mjs dist/views/ResourceListPage.js 50000 && node ../scripts/check-package-size.mjs dist/views/ResourceSearch.js 25000 && node ../scripts/check-package-size.mjs dist/views/ResourcePagination.js 25000",

154 "check": "npm run theme:audit && tsc -p tsconfig.json --noEmit",

155 "theme:audit": "node cli/command-center-sdk.mjs theme audit --path styles.css",

156 "test": "vitest run && node --test tests/cli/*.node.mjs",

Medium

Suspicious Lifecycle Evidence

postinstall executes cli/postinstall.mjs.

package.jsonView on unpkg · L151

157 "test:browser": "npm run build && playwright test --config playwright.config.ts",

158 "test:package-smoke": "node tests/cli/packed-consumer-smoke.mjs",

159 "prepack": "npm run build",

160 "postinstall": "node ./cli/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L160

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L160

161 },

162 "peerDependencies": {

163 "react": ">=18 <20",

164 "react-dom": ">=18 <20"

165 },

166 "dependencies": {

167 "lucide-react": "^0.500.0",

168 "react-markdown": "^10.1.0",

169 "rehype-raw": "^7.0.0",

170 "rehype-sanitize": "^6.0.0",

171 "remark-gfm": "^4.0.1"

172 },

173 "devDependencies": {

174 "@playwright/test": "^1.62.1",

175 "@types/react": "^19.0.0",

176 "@types/react-dom": "^19.0.0",

177 "ajv": "^8.20.0",

178 "jsdom": "^29.1.0",

179 "react": "^19.0.0",

180 "react-dom": "^19.0.0",

cli/install-agent-skills.mjsView file

Lines 1-21javascript

1import { cp, lstat, mkdir, mkdtemp, readdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";

2import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

cli/install-agent-skills.mjsView on unpkg · L1

3import { fileURLToPath } from