@getmikie/cli@1.1.118: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@getmikie/cli@1.1.118: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/reconcile-install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

14"scripts": { "postinstall": "node ./scripts/reconcile-install.mjs" }

High

Suspicious Lifecycle Evidence

The package runs a reconciliation script automatically in postinstall.

package.jsonView on unpkg · L14

scripts/reconcile-install.mjsView file

544const prepared = await commands.run(binary, CLIENT_REPAIR_ARGUMENTS, { shell: false, capture: true, environment: { ...baseEnvironment, MIKIE_NPM_UPDATE_REPAIR_PHASE: "prepare" }, }); const preparedReceipt = parseClientRepair(prepared, { allowLegacyDeferred: allowDeferred });

High

Ai Review Evidence

The install script invokes a native binary to prepare and commit Claude hook repair.

scripts/reconcile-install.mjsView on unpkg · L544

588const scriptIdentity = pathIdentity(fileURLToPath(import.meta.url), process.platform); const invokedIdentity = pathIdentity(process.argv[1], process.platform); if (scriptIdentity !== null && scriptIdentity === invokedIdentity) { try { await reconcileInstalledTrajectory(); const packageMetadata = JSON.parse( await readFile(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"), ); const clients = await reconcileInstalledClients({ version: packageMetadata.version, allowDeferred: true, });

High

Ai Review Evidence

The install script invokes a native binary to prepare and commit Claude hook repair.

scripts/reconcile-install.mjsView on unpkg · L588

lib/update.mjsView file

242function expectedOwnership(candidateBinary) { const handlers = {}; for (const [wireEvent, commandEvent] of CLAUDE_HOOK_EVENTS) { handlers[wireEvent] = { args: ["run-claude-hook", commandEvent], command: candidateBinary, type: "command", }; } return { launcher: sha256Text(candidateBinary), handlers: sha256Text(canonicalJson(handlers)), }; }

High

Suspicious Lifecycle Evidence

The source defines command handlers for every listed Claude lifecycle event.

lib/update.mjsView on unpkg · L242

bin/mikie.mjsView file

157providerPaths: { registration: path.join(customerHome, ".claude.json"), settings: path.join(customerHome, ".claude", "settings.json"), ownership: path.join(customerHome, ".claude", "mikie-evidence-hook-ownership.json"), },

High

Ai Review Evidence

The same codebase identifies Claude configuration and ownership files in the user home directory.

bin/mikie.mjsView on unpkg · L157

Source & flagged code

7 flagged

package.jsonView file

Lines 1-35json

1{

2 "name": "@getmikie/cli",

3 "version": "1.1.118",

4 "description": "Native Mikie relay launcher for MCP clients",

5 "license": "Apache-2.0",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/Zyph3rKeaton/new-ai-language.git"

9 },

10 "type": "module",

11 "bin": {

12 "mikie": "bin/mikie.mjs"

13 },

14 "scripts": {

15 "postinstall": "node ./scripts/reconcile-install.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

16 },

High

Suspicious Lifecycle Evidence

The package runs a reconciliation script automatically in postinstall.

package.jsonView on unpkg · L14

17 "files": [

18 "bin",

19 "lib",

20 "scripts",

21 "README.md"

22 ],

23 "engines": {

24 "node": ">=22"

25 },

26 "optionalDependencies": {

27 "@getmikie/darwin-arm64": "1.1.118",

28 "@getmikie/darwin-x64": "1.1.118",

29 "@getmikie/linux-x64-gnu": "1.1.118",

30 "@getmikie/win32-x64": "1.1.118"

31 },

32 "publishConfig": {

33 "access": "public",

34 "registry": "https://registry.npmjs.org"

35 }

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

scripts/reconcile-install.mjsView file

Lines 524-608javascript

524 }

525 const preserved = explicitMarker

526 ? [authority.runtime_sha256]

527 : await retainedRuntimeDigests(markerRoot, platform);

528 if (!

lib/update.mjsView file

Lines 222-262javascript

222 if (text[index] === '"') {

223 parseString();

224 return;

225 }

226 for (const literal of [

bin/mikie.mjsView file

Lines 137-177javascript

137 platformPackageJson: stagedPlatform,

138 binary: path.join(

139 path.dirname(stagedPlatform),

140 ...selected.binaryPath.split("/"),

141 ),

142