registry / AI-agent control-surface risk / @flightmaster/dast-cli
@flightmaster/dast-cli
DAST MCP CLI — fixed single-server client for Flight Master aviation data
This report shows the evidence for @flightmaster/dast-cli@1.0.2. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package uses postinstall to write instructions into multiple foreign AI-agent skill directories, rather than requiring an explicit user setup action. This meets the install-time AI-agent control-surface abuse blocking policy.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm installation runs the postinstall lifecycle hook.
Impact
Existing AI-agent environments can be persistently altered without an explicit setup command, causing future requests to invoke the package and its remote service.
Mechanism
Automatic cross-agent skill installation and behavioral instruction injection.
Policy narrative
On installation, the postinstall hook runs a script that detects several unrelated AI-agent directories and copies a package-provided skill into each one. The planted skill instructs agents to always call this CLI for a broad category of user requests. This is an unconsented lifecycle mutation of foreign AI-agent control surfaces, creating persistent control over later agent actions.
AI rationale
The package uses postinstall to write instructions into multiple foreign AI-agent skill directories, rather than requiring an explicit user setup action. This meets the install-time AI-agent control-surface abuse blocking policy.
Evidence
package.jsondist/scripts/auto-install-skill.jsskills/SKILL.md~/.cursor/skills/dast-mcp/SKILL.md~/.trae/skills/dast-mcp/SKILL.md~/.claude/skills/dast-mcp/SKILL.md~/.agents/skills/dast-mcp/SKILL.md
Network endpoints1
fly.huoli.com/mcp/dast_mcp
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.
Evidence for policy risk
- The automatic postinstall hook loads the skill installer without a user command.
- The installer writes a skill into four unrelated AI-agent home-directory control surfaces when their base directories exist.
- The installed skill directs an agent to always use this CLI for broad flight-related requests.
Evidence against
- The network client only sends requests after a CLI command and requires the DAST_API_KEY value.
- No shell execution, payload download, or runtime self-dependency was found.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "try{require('./dist/scripts/auto-install-skill.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require('./dist/scripts/auto-install-skill.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg20"prepublishOnly": "npm run build",
"postinstall": "node -e \"try{require('./dist/scripts/auto-install-skill.js')}catch(e){if(e.code!=='MODULE_NOT_FOUND')throw e}\""
Findings
1 Critical4 High2 Medium5 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedpackage.json
HighKnown Malware Source Fingerprint Signaturedist/client/gateway.js
HighSuspicious Lifecycle Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @flightmaster/dast-cli@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing @flightmaster/dast-cli@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.