Loading npm security reports…

@getfrontline/cli@1.5.0: AI-agent control-surface risk | LPM Firewall

registry / @getfrontline/cli / 1.5.0

@getfrontline/cli@1.5.0

Frontline CLI — Public API (agents, workflows, billing, tables, objects) + Max chat/admin REST from your terminal

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies the global Claude Code skills control surface when Claude Code is detected. It deploys many package-supplied instruction files without an explicit setup command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs postinstall on a machine where Claude Code or its configuration directory is present.

Impact

Package-supplied instructions can influence future Claude Code sessions for that user.

Mechanism

Automatic global Claude Code skill installation.

Policy narrative

The package declares postinstall, which starts its bundled installer. When it detects Claude Code or its configuration directory, the installer writes numerous bundled SKILL.md files into the user's global ~/.claude/skills directory and records hashes there. This changes a foreign AI-agent instruction surface merely by installing the npm package, rather than requiring the user to invoke its explicit setup command.

Rationale

This is an unconsented postinstall mutation of a broad, foreign AI-agent control surface. The absence of network exfiltration does not remove the persistent instruction-injection risk.

Evidence

package.jsonscripts/runPostinstall.mjsdist/scripts/postinstall.jsdist/skills/*/SKILL.md~/.claude/skills/<skill>/SKILL.md~/.claude/skills/<skill>/.frontline-hash

Decision evidence

Source & flagged code

4 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "@getfrontline/cli",

3 "version": "1.5.0",

4 "description": "Frontline CLI — Public API (agents, workflows, billing, tables, objects) + Max chat/admin REST from your terminal",

5 "private": false,

6 "type": "commonjs",

7 "main": "./dist/index.js",

8 "types": "./dist/index.d.ts",

9 "bin": {

10 "frontline": "dist/index.js",

11 "max": "dist/max.js"

12 },

13 "files": [

14 "dist",

15 "scripts/runPostinstall.mjs"

16 ],

17 "scripts": {

18 "build": "node ./scripts/clean.mjs && tsc -p tsconfig.json && node ./scripts/addShebang.mjs && node ./scripts/copyStatic.mjs",

19 "dev:frontline": "ts-node src/index.ts",

20 "dev:max": "ts-node src/max.ts",

21 "postinstall": "node ./scripts/runPostinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

22 "pack": "npm pack --dry-run",

23 "prepublishOnly": "npm run build"

24 },

25 "keywords": [

26 "frontline",

27 "cli",

28 "api",

29 "max",

30 "agents",

31 "getfrontline",

32 "workflows",

33 "crm"

34 ],

35 "license": "MIT",

36 "dependencies": {

37 "chalk": "^4.1.2",

38 "commander": "^13.1.0",

39 "conf": "^10.2.0",

40 "ora": "^5.4.1",

41 "terminal-image": "^3.1.1"

dist/commands/workflows/nodes.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/workflows/nodes.js#virtual:normalized:round1View on unpkg

dist/max/browserLogin.jsView file

•matchType = normalized_sha256 matchedPackage = @getfrontline/cli@1.0.20 matchedPath = dist/max/browserLogin.js matchedIdentity = npm:QGdldGZyb250bGluZS9jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/max/browserLogin.jsView on unpkg

scripts/runPostinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = @getfrontline/cli@1.0.20 matchedPath = scripts/runPostinstall.mjs matchedIdentity = npm:QGdldGZyb250bGluZS9jbGk:1.0.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/runPostinstall.mjsView on unpkg