Loading npm security reports…

@henri-ralmeida/prumo@1.3.12: AI-agent control-surface risk | LPM Firewall

registry / @henri-ralmeida/prumo / 1.3.12

@henri-ralmeida/prumo@1.3.12

Evidence-driven task orchestration with PO First for Claude Code, Kiro and Codex

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically detects and alters supported AI-agent environments, then enables a persistent dashboard. This occurs without an explicit Prumo command from the user.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during a global installation of the package.

Impact

It can inject Prumo instructions and skills into Claude, Kiro, or Codex control surfaces and create a user-login background process.

Mechanism

Automatic all-environment agent configuration mutation and dashboard autostart registration.

Policy narrative

The postinstall hook conditionally runs the package CLI with `install --all`, which automatically detects agent products and writes their global or project instruction and skill locations. After any successful installation it enables a dashboard, registering it with launchd, systemd, or an equivalent login mechanism. The source limits the dashboard network listener to loopback, but that does not remove the unconsented install-time mutation of foreign AI-agent control surfaces or persistence.

AI rationale

This is a concrete unconsented postinstall chain that mutates broad AI-agent configuration surfaces and registers persistence. The loopback-only dashboard and lack of observed credential exfiltration do not neutralize that install-time behavior.

Evidence

package.jsonscripts/postinstall.mjslib/install.mjslib/autostart.mjs~/.claude/settings.json~/.claude/skills/prumo~/.kiro/steering/po-first.md

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/autostart.mjsView file

1Trigger-reachable persistence chain: manifest.bin -> bin/prumo.mjs -> lib/autostart.mjs L1: import { execFileSync, spawn, spawnSync } from 'node:child_process' L2: import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs' L3: import { createServer } from 'node:net' L4: import { homedir } from 'node:os' ... L22: const source = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new(); $p=Get-CimInstance Win32_Process -Filter "ProcessId = ${id}"; if ($null -eq $p) { exit 1 }; @{ executab... L23: return JSON.parse(execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', source], { encoding: 'utf8', windowsHide: true, timeout: 10000 })) L24: } ... L33: function defaults(options = {}) { L34: const home = options.home ??

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/autostart.mjsView on unpkg · L1

1import { execFileSync, spawn, spawnSync } from 'node:child_process' L2: import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs' L3: import { createServer } from 'node:net' L4: import { homedir } from 'node:os' ... L22: const source = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new(); $p=Get-CimInstance Win32_Process -Filter "ProcessId = ${id}"; if ($null -eq $p) { exit 1 }; @{ executab... L23: return JSON.parse(execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', source], { encoding: 'utf8', windowsHide: true, timeout: 10000 })) L24: } ... L33: function defaults(options = {}) { L34: const home = options.home ?? homedir() L35: const platform = options.platform ?? process.platform L36: const packageR

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/autostart.mjsView on unpkg · L1

lib/install.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, lstatSync, renameSync, unlinkSync, rmdirSync, copyFileSync, statSync, accessSync, constants, readlinkSync,... L2: import { homedir } from 'node:os' ... L73: } else if (stat.isDirectory()) { L74: mkdirSync(destination, { recursive: true }) L75: for (const name of readdirSync(source)) copySnapshot(join(source, name), join(destination, name)) L76: } else { L77: mkdirSync(dirname(destination), { recursive: true }) L78: copyFileSync(source, destination, constants.COPYFILE_EXCL) L79: } ... L129: const registryFile = home => join(home, '.local', 'share', 'prumo', 'installations.json') L130: const configFor = (harness, home, env) => harness === 'claud

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.mjsView on unpkg · L1

scripts/serve.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/serve.mjs#virtual:normalized:round1View on unpkg

scripts/validation.mjsView file

•matchType = normalized_sha256 matchedPackage = @henri-ralmeida/prumo@1.3.8 matchedPath = scripts/validation.mjs matchedIdentity = npm:QGhlbnJpLXJhbG1laWRhL3BydW1v:1.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/validation.mjsView on unpkg

scripts/i18n.mjsView file

•matchType = normalized_sha256 matchedPackage = @henri-ralmeida/prumo@1.3.8 matchedPath = scripts/i18n.mjs matchedIdentity = npm:QGhlbnJpLXJhbG1laWRhL3BydW1v:1.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/i18n.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-22json

1{

2 "name": "@henri-ralmeida/prumo",

3 "version": "1.3.12",

4 "description": "Evidence-driven task orchestration with PO First for Claude Code, Kiro and Codex",

5 "type": "module",

6 "bin": { "prumo": "bin/prumo.mjs" },

7 "engines": { "node": ">=22" },

8 "license": "MIT",

9 "author": "Henrique Almeida",

10 "repository": { "type": "git", "url": "git+https://github.com/henri-ralmeida/prumo.git" },

11 "homepage": "https://github.com/henri-ralmeida/prumo#readme",

12 "bugs": "https://github.com/henri-ralmeida/prumo/issues",

13 "keywords": ["agent-skills", "claude-code", "kiro", "codex", "orchestration", "po-first"],

14 "files": ["bin/", "lib/", "scripts/*.mjs", "!scripts/*.test.mjs", "!scripts/*-smoke.mjs", "scripts/messages.json", "scripts/release-notes.json", "scripts/dashboard.html", "references/", "SKILL.md", "README.md", "README.pt-BR.md", "CHANGELOG.md", "LICENSE"],

15 "scripts": {

16 "test": "node --test scripts/*.test.mjs test/*.test.mjs",

17 "check": "node scripts/check-package.mjs",

18 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepack": "node scripts/check-package.mjs"

20 }

21}

22

lib/autostart.mjsView file

Lines 1-21javascript

1import { execFileSync, spawn, spawnSync } from 'node:child_process'

2import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'

3import { createServer } from 'node:net'

4import { homedir } from 'node:os'

High

Trigger Reachable Persistence

lib/install.mjsView file

Lines 1-21javascript

1import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, lstatSync, renameSync, unlinkSync, rmdirSync, copyFileSync, statSync, accessSync, constants, readlinkSync, symlinkSync, realpathSync } from 'node:fs'

2import { homedir } from 'node:os'

3import { resolve, dirname, join, relative, sep, isAbsolute, delimiter } from 'node:path'

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.mjsView on unpkg · L1

4

scripts/serve.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/serve.mjs#virtual:normalized:round1View on unpkg

scripts/validation.mjsView file

•matchType = normalized_sha256 matchedPackage = @henri-ralmeida/prumo@1.3.8 matchedPath = scripts/validation.mjs matchedIdentity = npm:QGhlbnJpLXJhbG1laWRhL3BydW1v:1.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/validation.mjsView on unpkg

scripts/i18n.mjsView file

•matchType = normalized_sha256 matchedPackage = @henri-ralmeida/prumo@1.3.8 matchedPath = scripts/i18n.mjs matchedIdentity = npm:QGhlbnJpLXJhbG1laWRhL3BydW1v:1.3.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/i18n.mjsView on unpkg