@devflow-tools/devflow: AI-agent control-surface risk | LPM Firewall

Loading npm security reports…

@devflow-tools/devflow: AI-agent control-surface risk | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin/dist/hooks/server-bootstrap.jsView file

1import {spawn,execFileSync}from'node:child_process';import {randomUUID}from'node:crypto';import {mkdirSync,writeFileSync,existsSync}from'node:fs';import {request}from'node:http';im... L2: SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'server_bootstrap_state'

High

Child Process

Package source references child process execution.

dist/plugin/dist/hooks/server-bootstrap.jsView on unpkg · L1

dist/cli.jsView file

30[${r.category}] (confidence: ${(r.confidence*100).toFixed(0)}%)`),console.log(` ${r.content}`);let s=await vc(" Approve? [y]es / [n]o / [s]kip: ");s==="y"?(await x(process.cwd(),... L31: Reviewed ${o}/${t.length} pending memories.`);}var xe=O(()=>{we();});var Sr={};A(Sr,{getDocsStatus:()=>_c,queryKnowledge:()=>_r,searchKnowledge:()=>bc,syncDocs:()=>Sc});async funct... L32: `);if(t.length>=2){let n=parseInt(t[0],10);if(!isNaN(n))return n}return null}function ut(e){if(!existsSync(e))return null;let t=readFileSync(e,"utf-8").trim().split(` L33: `),n=t.length>=2?t[1]:t[0],o=parseInt(n,10);return isNaN(o)?null:o}async function Fn(e){let t=Yc(),n=Mn(process.cwd()),o=randomUUID(),r=spawn(process.execPath,[t,"--devflow-instanc... L34: ${r.pid??0}`),writeRuntimeEndpointState({url:`http://127

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L30

scripts/postinstall.jsView file

2Install-time AI-agent control hijack evidence: L2: // L3: // Auto-configures .claude/hooks.json in the consuming project so that Claude L4: // Code invokes the devflow PreToolUse hook on every tool call. ... L11: L12: import { writeFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'; L13: import { join, dirname } from 'node:path'; ... L55: L56: const claudeDir = join(projectRoot, '.claude'); L57: const hooksFile = join(claudeDir, 'hooks.json'); ... L59: L60: // 1. Ensure .claude/ directory exists L61: if (!existsSync(claudeDir)) { Payload evidence from dist/plugin/dist/skills/devflow:git/SKILL.md: L56: L57: 以下版本描述知识源，不代表目标项目版本；目标项目的 package.json 与 lockfile 证据始终优先。 L58: L59: - conventional-commits: 1.0.0 — https://www.conventionalcommits.org/en/v1.0.0/ L60: - git-scm-docs: 2

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L2

dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.12.5 matchedPath = dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.jsView on unpkg

dist/dashboard/_next/static/chunks/main-3175faffdbfc3051.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.12.5 matchedPath = dist/dashboard/_next/static/chunks/main-595171e579e3e067.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/main-3175faffdbfc3051.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@devflow-tools/devflow",

3 "version": "0.16.30",

4 "type": "module",

5 "description": "DevFlow - Developer Intelligence Platform (Distribution Package)",

6 "bin": {

7 "devflow": "./bin/devflow"

8 },

9 "scripts": {

10 "build": "tsup",

11 "audit-session-data": "tsx scripts/audit-session-data.ts",

12 "build:watch": "tsup --watch",

13 "clean": "rm -rf dist",

14 "postbuild": "cp ../../apps/server/public/fallback.html dist/fallback.html && npx tsx scripts/bundle-plugin.ts && mkdir -p ../../plugins/claude-code/dist/hooks && cp dist/hooks/*.js ../../plugins/claude-code/dist/hooks/",

15 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "dependencies": {

18 "@colbymchenry/codegraph": "^1.1.1",

19 "@devflow-tools/adapters": "0.16.30",

20 "@devflow-tools/benchmark": "0.16.30",

21 "@devflow-tools/context-engine": "0.16.30",

22 "@devflow-tools/database": "0.16.30",

23 "@devflow-tools/knowledge-engine": "0.16.30",

24 "@devflow-tools/mcp-server": "0.16.30",

25 "@devflow-tools/memory-engine": "0.16.30",

26 "@devflow-tools/sdk": "0.16.30",

27 "@devflow-tools/server": "0.16.30",

28 "@devflow-tools/telemetry": "0.16.30",

29 "@devflow-tools/workflow-engine": "0.16.30",

30 "@inquirer/prompts": "^7.10.1",

31 "@modelcontextprotocol/sdk": "^1.0.0",

32 "@nestjs/common": "^10.4.0",

33 "@nestjs/core": "^10.4.0",

34 "@nestjs/platform-fastify": "^10.4.0",

35 "chalk": "^5.3.0",

dist/plugin/dist/hooks/server-bootstrap.jsView file

Lines 1-21javascript

1import {spawn,execFileSync}from'node:child_process';import {randomUUID}from'node:crypto';import {mkdirSync,writeFileSync,existsSync}from'node:fs';import {request}from'node:http';import {createRequire}from'node:module';import {homedir}

dist/cli.jsView file

Lines 10-50javascript

10No plugins available. You can install plugins later with:`),console.log(" devflow plugin list"),console.log(` devflow plugin install <name>

11`),[];console.log(`

12\u{1F50C} Plugin Installation Guide

13`);let n=resolveProjectCapabilityProfile(e,{registry:t}),o=n.detectedStacks;o.length>0&&console.log(`Detected tech stack: ${o.join(", ")}

14

scripts/postinstall.jsView file

Lines 1-22javascript

1// packages/devflow/scripts/postinstall.js

2//

3// Auto-configures .claude/hooks.json in the consuming project so that Claude

4// Code invokes the devflow PreToolUse hook on every tool call.

5//

6// This file is plain ESM JavaScript (not TypeScript) because it must run during

7// `npm install` before any build step has compiled the package.

8//

9// If anything goes wrong we log a warning and exit 0 — we must never break a

10// user's `npm install`.

dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.12.5 matchedPath = dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.jsView on unpkg

dist/dashboard/_next/static/chunks/main-3175faffdbfc3051.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.12.5 matchedPath = dist/dashboard/_next/static/chunks/main-595171e579e3e067.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard/_next/static/chunks/main-3175faffdbfc3051.jsView on unpkg