Loading npm security reports…

@guandata/guanmetric@0.1.18: AI-agent control-surface risk | LPM Firewall

registry / @guandata/guanmetric / 0.1.18

@guandata/guanmetric@0.1.18

观远 BI 指标写操作工具 - 指标创建编辑删除、指标目录、公共维度、Excel 标准化

AI Security Review

scanned 9d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global-install postinstall hook automatically installs an AI skill into external assistant configuration directories. It also removes a WorkBuddy safety preload for the child installation process.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Installing this package globally without the opt-out environment variable.

Impact

A package installation can alter foreign AI-agent control surfaces and bypass a configured WorkBuddy safety preload without a separate user command.

Mechanism

The postinstall hook runs the launcher, which invokes a noninteractive skills installer and copies the bundled skill to CodeBuddy and WorkBuddy configuration paths.

Policy narrative

On global installation, the lifecycle hook automatically starts a skill installer. The launcher uses a noninteractive skills command, copies package content into CodeBuddy and WorkBuddy home configuration directories, and strips a WorkBuddy safe-delete preload from the child environment. This is an unconsented lifecycle mutation of foreign AI-agent control surfaces.

AI rationale

The automatic global postinstall path modifies external agent configuration and disables a named safety preload for its child process. Those concrete behaviors meet the install-control-surface blocking boundary.

Evidence

package.jsonbin/postinstall.jsbin/run.jsbin/install-env.js.codebuddy/skills/guanmetric.workbuddy/skills/guanmetric

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

8"scripts": { "postinstall": "node bin/postinstall.js", "

High

Suspicious Lifecycle Evidence

The package declares an automatic postinstall hook.

package.jsonView on unpkg · L8

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/run.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @guandata/guanmetric@0.1.9 matchedIdentity = npm:QGd1YW5kYXRhL2d1YW5tZXRyaWM:0.1.9 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/run.jsView on unpkg

163const args = [ // --yes: postinstall 等非交互环境下 npx 需要免确认下载 skills CLI "--yes", "skills", "add", pkgRoot, "--skill", "guanmetric", "-g", "-y", ...extraArgs, ];

High

Ai Review Evidence

The command noninteractively invokes the skills CLI to install this package globally.

bin/run.jsView on unpkg · L163

100function installBuddySkills(pkgRoot, skill) { const srcDir = path.join(pkgRoot, "skills", skill); if (!fs.existsSync(path.join(srcDir, "SKILL.md"))) { console.warn(`Warning: skipping buddy install; skill not found: ${srcDir}`); return; } const targets = [ { name: "CodeBuddy", configDir: process.env.CODEBUDDY_CONFIG_DIR || path.join(os.homedir(), ".codebuddy"), }, { name: "WorkBuddy", configDir: proce

High

Ai Review Evidence

The launcher copies the skill into CodeBuddy and WorkBuddy home configuration directories.

bin/run.jsView on unpkg · L100

bin/postinstall.jsView file

36console.log(`[${CLI_NAME}] postinstall: refreshing AI skill (${CLI_NAME} install-skill)...`); const result = spawnSync( process.execPath, [path.join(__dirname, "run.js"), "install-skill"],

High

Ai Review Evidence

The hook launches install-skill during global installs.

bin/postinstall.jsView on unpkg · L36

Source & flagged code

7 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@guandata/guanmetric",

3 "version": "0.1.18",

4 "description": "观远 BI 指标写操作工具 - 指标创建编辑删除、指标目录、公共维度、Excel 标准化",

5 "bin": {

6 "guanmetric": "bin/run.js"

7 },

8 "scripts": {

9 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "build": "node scripts/build.js && node scripts/sync-skill.js",

High

Suspicious Lifecycle Evidence

The package declares an automatic postinstall hook.

package.jsonView on unpkg · L8

11 "pack:all": "node scripts/pack-all.js",

12 "test:build-script": "node scripts/platform-tests.js build && node scripts/platform-tests.js run",

13 "test:package-layout": "node scripts/platform-tests.js layout && node scripts/platform-tests.js install-smoke",

14 "test:auto-select": "node scripts/platform-tests.js auto-select",

15 "verify:platforms": "node scripts/verify-platforms.js",

16 "changelog": "node ../../scripts/generate-release-changelog.js .",

17 "check-changelog": "node ../../scripts/check-release-changelog.js .",

18 "prepublishOnly": "npm run test:build-script && npm run check-changelog && npm run build && node scripts/preflight.js && npm run test:package-layout && npm run test:auto-select"

19 },

20 "files": [

21 "bin/",

22 "skills/",

23 "CHANGELOG.md",

24 "LICENSE",

25 "LICENSE.zh-CN",

26 "README.md"

27 ],

28 "keywords": [

29 "guandata",

bin/run.jsView file

Lines 80-120javascript

80

81function getBinaryPath(options = {}) {

82 return resolvePlatformBinaries(options).binaryPaths[BINARY_NAMES[0]];

83}

84

85function copyDirectory

bin/postinstall.jsView file

Lines 16-56javascript

16"use strict";

17

18const { spawnSync } = require("child_process");

19const path = require("path");

20