Loading npm security reports…

@drdeeks/character-kit@1.2.1: AI-agent control-surface risk | LPM Firewall

registry / @drdeeks/character-kit / 1.2.1

@drdeeks/character-kit@1.2.1

Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently modifies Claude Code's user hook configuration and starts persistent local enforcement processes. The installed hook routes every matching Claude PreToolUse action through this package daemon.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install -g @drdeeks/character-kit

Impact

Hijacks a foreign AI-agent control surface and can block or mediate tool calls.

Mechanism

unconsented postinstall hook injection and detached daemon startup

Policy narrative

On global installation, postinstall auto-detects Claude Code and invokes the non-interactive installer. That installer writes a wildcard PreToolUse command into ~/.claude/settings.json, sourcing its environment and calling the package hook for every tool use. It also starts detached daemon, monitor, and watchdog processes. This is an unconsented install-time mutation of a foreign AI-agent control surface.

Rationale

The lifecycle hook performs concrete, unprompted Claude configuration mutation and persistence during npm installation. This satisfies the block boundary despite no observed network exfiltration.

Evidence

package.jsonnode/bin/postinstall.jsnode/bin/install.jsnode/enforcer/agent_enforcer_daemon.js~/.claude/settings.json~/.agent-character-kit/workspace/.agent/.env~/.agent-character-kit/workspace/.agent/enforcer.sock

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node node/bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node node/bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

deploy/ack_watchdog.jsView file

18import { fileURLToPath } from "url"; L19: import { spawn, spawnSync } from "child_process"; L20:

High

Child Process

Package source references child process execution.

deploy/ack_watchdog.jsView on unpkg · L18

node/enforcer/agent_enforcer_daemon.jsView file

51// 1. Check workspace-specific .env (set by install.js per-workspace) L52: const __wsEnv = process.env.AGENT_WORKSPACE && path.join(process.env.AGENT_WORKSPACE, ".agent", ".env"); L53: if (__wsEnv) _loadEnvFile(__wsEnv); ... L58: L59: import net from "net"; L60: import fs from "fs"; ... L62: import path from "path"; L63: import { execSync } from "child_process"; L64: import yaml from "js-yaml";

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

node/enforcer/agent_enforcer_daemon.jsView on unpkg · L51

node/bin/postinstall.jsView file

31* - Auto-detects which harnesses are actually present on this machine L32: * (Claude: ~/.claude/settings.json, Hermes: ~/.hermes/, OpenCode: L33: * ~/.config/opencode/) and wires a companion for each one found, ... L64: const candidates = [ L65: { harness: "claude", marker: path.join(home, ".claude", "settings.json") }, L66: { harness: "hermes", marker: path.join(home, ".hermes") }, ... L80: const write = (line) => { L81: try { fs.appendFileSync(log, line + "\n"); } catch { /* best-effort */ } L82: };

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

node/bin/postinstall.jsView on unpkg · L31

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

node/bin/ack.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @drdeeks/character-kit@1.5.0 matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.5.0 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@drdeeks/character-kit",

3 "version": "1.2.1",

4 "description": "Universal agent character enforcement, knowledge indexing, and memory with YAML frontmatter. True plugin: install once, reference as @character-kit in any harness config.",

5 "main": "node/src/index.js",

6 "bin": {

7 "ack": "node/bin/ack.js",

8 "character-kit": "node/bin/ack.js"

9 },

10 "type": "module",

11 "scripts": {

12 "test": "node --test node/tests/*.test.js",

13 "start": "node bin/ack.js",

14 "ack-install": "node node/bin/install.js",

15 "postinstall": "node node/bin/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "keywords": [

18 "agent",

19 "character",

20 "agent-character",

21 "enforcement",

22 "knowledge",

23 "memory",

24 "semantic-search",

25 "hooks",

26 "yaml",

27 "frontmatter",

28 "claude",

29 "cursor",

30 "gemini",

31 "hermes",

32 "opencode"

33 ],

34 "author": "drdeeks",

35 "license": "MIT",

deploy/ack_watchdog.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2/**

3 * ACK monitor watchdog (self-healing companion, Node-native).

4 *

5 * Node port of ack_watchdog.py. Revives the acknowledgment monitor

6 * (ack_monitor.js) if it dies, and revives the enforcer daemon itself in

7 * root-mode installs. This is the self-healing layer: no single process in

8 * the daemon/monitor/watchdog trio is a point of failure on its own.

9 *

10 * Revival order: prefer `systemctl restart <unit>` (idempotent, re-reads the

node/enforcer/agent_enforcer_daemon.jsView file

Lines 31-71javascript

31// from .env itself, and the supervisor/systemd passes it to the daemon's

32// LAUNCH env. Auto-loading it here would make the daemon self-gate

33// against any client that doesn't also inherit this repo's .env (e.g. the

34// test harness, or a companion launched without it) — breaking legit calls.

35import { fileURLToPath } from "url";

36const __daemonDir = path.dirname

node/bin/postinstall.jsView file

Lines 11-51javascript

11 * not something this script can work around. So this does the opposite:

12 * a fully non-interactive, auto-detected, safe-by-construction setup that

13 * needs no TTY and no prompt to be useful immediately after install.

python/tests/python_parity_test.pyView file

•path = python/tests/python_parity_test.py kind = payload_in_excluded_dir sizeBytes = 2981 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

python/tests/python_parity_test.pyView on unpkg

•path = python/tests/python_parity_test.py kind = build_helper sizeBytes = 2981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

python/tests/python_parity_test.pyView on unpkg

node/bin/ack.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @drdeeks/character-kit@1.5.0 matchedIdentity = npm:QGRyZGVla3MvY2hhcmFjdGVyLWtpdA:1.5.0 similarity = 0.350 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node/bin/ack.jsView on unpkg