Loading npm security reports…

@eternalnight/publish-kit@0.2.0: AI-agent control-surface risk | LPM Firewall

registry / @eternalnight/publish-kit / 0.2.0

@eternalnight/publish-kit@0.2.0

Release playbook for AI agents. npm-installable CLI + DSH plugin + skill bundle. Covers npm, GitHub+Gitee dual remote, DSH marketplace, cargo crates.io, PyPI, PyInstaller exe, Go single-binary, Rust single-binary, Electron/Tauri desktop. Bilingual EN/ZH.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies several cross-vendor AI-agent skill roots. It replaces same-named symlinks with links to the package-provided skill directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, which invokes postinstall automatically.

Impact

The package can change which instructions are loaded by multiple local AI-agent products without an explicit setup command.

Mechanism

Install-time cross-agent skill-root symlink replacement.

Policy narrative

During npm installation, the postinstall hook iterates across five agent skill roots. For each root it deletes an existing publish-kit symlink, creates the parent directory if needed, and links it to this package's bundled skill. This is an unconsented install-time mutation of a broad, foreign AI-agent control surface.

Rationale

The automatic postinstall hook modifies skill discovery locations for multiple unrelated AI-agent products and can replace existing links. Although no exfiltration or network activity was found, this concrete broad control-surface mutation meets the install-hook abuse blocking policy.

Evidence

package.jsonscripts/postinstall.jscordis.patch.yml.agents/skills/publish-kit~/.agents/skills/publish-kit~/.claude/skills/publish-kit~/.codex/skills/publish-kit~/.gemini/skills/publish-kit~/.dsh/skills/publish-kit

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

61"scripts": { "postinstall": "node ./scripts/postinstall.js" }

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically on installation.

package.jsonView on unpkg · L61

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

8L9: const PACKAGE_SKILL_SRC = path.join(__dirname, '..', '.agents', 'skills', 'publish-kit'); L10: const SKILL_NAME = 'publish-kit'; ... L17: const homes = [ L18: path.join(os.homedir(), '.agents', 'skills'), L19: path.join(os.homedir(), '.claude', 'skills'), L20: path.join(os.homedir(), '.codex', 'skills'), L21: path.join(os.homedir(), '.gemini', 'skills'), ... L38: } L39: fs.mkdirSync(dir, { recursive: true }); L40: fs.symlinkSync(PACKAGE_SKILL_SRC, dest, 'junction');

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L8

17const homes = [ path.join(os.homedir(), '.agents', 'skills'), path.join(os.homedir(), '.claude', 'skills'), path.join(os.homedir(), '.codex', 'skills'), path.join(os.homedir(), '.gemini', 'skills'), path.join(os.homedir(), '.dsh', 'skills'), ];

High

Ai Review Evidence

The hook targets skill roots for five separate agent products, including Codex, Claude, Gemini, DSH, and a shared agents directory.

scripts/postinstall.jsView on unpkg · L17

29if (fs.existsSync(dest)) { const stat = fs.lstatSync(dest); if (stat.isSymbolicLink()) { fs.unlinkSync(dest); } else { // A real directory with the same name exists; skip (don't clobber). console.log('[publish-kit] ' + dest + ' already exists (not a symlink); skipping'); continue; } } fs.mkdirSync(dir, { recursive: true }); fs.symlinkSync(PACKAGE_SKILL_SRC, dest, 'junction');

High

Ai Review Evidence

The hook removes an existing symlink, creates each target directory, and replaces it with a link to this package's skill bundle.

scripts/postinstall.jsView on unpkg · L29

scripts/release-exe.ps1View file

•path = scripts/release-exe.ps1 kind = build_helper sizeBytes = 7073 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-exe.ps1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 41-82json

41 "files": [

42 "README.md",

43 "README.zh.md",

44 "LICENSE",

45 "CHANGELOG.md",

46 "scripts/bootstrap-release.ps1",

47 "scripts/bootstrap-release.sh",

48 "scripts/release-exe.ps1",

49 "scripts/release-exe.sh",

50 ".agents/skills/publish-kit/SKILL.md",

51 ".agents/skills/publish-kit/REFERENCE.md",

52 ".agents/skills/publish-kit/TEMPLATE.md",

53 ".agents/skills/publish-kit/INSTALL.md",

54 ".agents/skills/publish-kit/DSH-DEPLOY.md",

55 ".agents/skills/publish-kit/COMPATIBILITY.md",

56 ".agents/skills/publish-kit/EXAMPLES.md",

57 "assets/readme-banner.svg",

58 "cordis.patch.yml",

59 "scripts/postinstall.js"

60 ],

61 "scripts": {

62 "postinstall": "node ./scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L62

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L62

63 },

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically on installation.

package.jsonView on unpkg · L61

64 "engines": {

65 "node": ">=18"

66 },

67 "dsh": {

68 "client": {

69 "platform": "web"

70 },

71 "bundle": {

72 "patch": "./cordis.patch.yml"

73 },

74 "marketplace": {

75 "profiles": ["web"],

76 "requiresBuildApproval": false,

77 "requiresRestart": true,

78 "manualSteps": false

79 }

80 }

81}

82

scripts/postinstall.jsView file

Lines 1-49javascript

1#!/usr/bin/env node

2// postinstall.js - Symlink the bundled skill directory into the user's agent skill roots.

3// Runs once when @eternalnight/publish-kit is installed via `npm install` or `dsh plugin add`.

4

5const fs = require('fs');

6const path = require

scripts/release-exe.ps1View file

•path = scripts/release-exe.ps1 kind = build_helper sizeBytes = 7073 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-exe.ps1View on unpkg