Loading npm security reports…

@getfrontline/cli@1.3.1: AI-agent control-surface risk | LPM Firewall

registry / @getfrontline/cli / 1.3.1

@getfrontline/cli@1.3.1

Frontline CLI — Public API (agents, workflows, billing, tables, objects) + Max chat/admin REST from your terminal

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically adds bundled instructions to Claude Code's global skills directory. Detection and overwrite protections do not provide consent to modify this foreign agent control surface.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall when Claude Code is detected through its executable or configuration directory.

Impact

Subsequent Claude Code sessions can load package-supplied instructions installed without explicit opt-in.

Mechanism

The lifecycle wrapper launches an installer that copies bundled SKILL.md files into Claude Code's skills directory and records tracking hashes.

Policy narrative

The npm lifecycle hook launches the bundled installer automatically. If Claude Code is present, it writes numerous bundled skills into that separate agent's global configuration. Existing customized files are protected, but fresh instructions are installed without an affirmative setup command or consent gate, altering the instructions available to future agent sessions.

AI rationale

Inspected source establishes unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. Hash protections limit overwrites but do not authorize installing new global agent instructions.

Evidence

package.jsonscripts/runPostinstall.mjsdist/scripts/postinstall.js.claudeSKILL.md.frontline-hash

Decision evidence

Source & flagged code

4 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@getfrontline/cli",

3 "version": "1.3.1",

4 "description": "Frontline CLI — Public API (agents, workflows, billing, tables, objects) + Max chat/admin REST from your terminal",

5 "private": false,

6 "type": "commonjs",

7 "main": "./dist/index.js",

8 "types": "./dist/index.d.ts",

9 "bin": {

10 "frontline": "dist/index.js",

11 "max": "dist/max.js"

12 },

13 "files": [

14 "dist",

15 "scripts/runPostinstall.mjs"

16 ],

17 "scripts": {

18 "build": "node ./scripts/clean.mjs && tsc -p tsconfig.json && node ./scripts/addShebang.mjs && node ./scripts/copyStatic.mjs",

19 "dev:frontline": "ts-node src/index.ts",

20 "dev:max": "ts-node src/max.ts",

21 "postinstall": "node ./scripts/runPostinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

22 "pack": "npm pack --dry-run",

23 "prepublishOnly": "npm run build"

24 },

25 "keywords": [

26 "frontline",

27 "cli",

28 "api",

29 "max",

30 "agents",

31 "getfrontline",

32 "workflows",

33 "crm"

34 ],

35 "license": "MIT",

36 "dependencies": {

37 "chalk": "^4.1.2",

38 "commander": "^13.1.0",

39 "conf": "^10.2.0",

40 "ora": "^5.4.1",

41 "terminal-image": "^3.1.1"

dist/commands/workflows/nodes.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/workflows/nodes.js#virtual:normalized:round1View on unpkg

scripts/runPostinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @getfrontline/cli@1.5.1 matchedPath = scripts/runPostinstall.mjs matchedIdentity = npm:QGdldGZyb250bGluZS9jbGk:1.5.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/runPostinstall.mjsView on unpkg

dist/max/browserLogin.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @getfrontline/cli@1.4.0 matchedIdentity = npm:QGdldGZyb250bGluZS9jbGk:1.4.0 similarity = 0.875 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/max/browserLogin.jsView on unpkg