@henri-ralmeida/prumo@1.3.8: Malicious npm security report | LPM Firewall

Loading npm security reports…

@henri-ralmeida/prumo@1.3.8: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/autostart.mjsView file

1Trigger-reachable persistence chain: manifest.bin -> bin/prumo.mjs -> lib/autostart.mjs L1: import { execFileSync, spawn, spawnSync } from 'node:child_process' L2: import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs' L3: import { createServer } from 'node:net' L4: import { homedir } from 'node:os' ... L22: const source = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new(); $p=Get-CimInstance Win32_Process -Filter "ProcessId = ${id}"; if ($null -eq $p) { exit 1 }; @{ executab... L23: return JSON.parse(execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', source], { encoding: 'utf8', windowsHide: true, timeout: 10000 })) L24: } ... L33: function defaults(options = {}) { L34: const home = options.home ??

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

lib/autostart.mjsView on unpkg · L1

1import { execFileSync, spawn, spawnSync } from 'node:child_process' L2: import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs' L3: import { createServer } from 'node:net' L4: import { homedir } from 'node:os' ... L22: const source = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new(); $p=Get-CimInstance Win32_Process -Filter "ProcessId = ${id}"; if ($null -eq $p) { exit 1 }; @{ executab... L23: return JSON.parse(execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', source], { encoding: 'utf8', windowsHide: true, timeout: 10000 })) L24: } ... L33: function defaults(options = {}) { L34: const home = options.home ?? homedir() L35: const platform = options.platform ?? process.platform L36: const packageR

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/autostart.mjsView on unpkg · L1

lib/install.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, lstatSync, renameSync, unlinkSync, rmdirSync, cpSync, statSync, accessSync, constants } from 'node:fs' L2: import { homedir } from 'node:os' ... L106: const registryFile = home => join(home, '.local', 'share', 'prumo', 'installations.json') L107: const configFor = (harness, home, env) => harness === 'claude' ? resolve(env.CLAUDE_CONFIG_DIR ?? join(home, '.claude')) : harness === 'codex' ? resolve(env.CODEX_HOME ?? join(home... L108: ... L129: if (harness === 'claude') { L130: if (existsSync(join(home, '.claude.json')) || existsSync(join(config, 'settings.json')) || populated(join(config, 'projects')) || managedSkill(join(config, 'skills'), ha

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.mjsView on unpkg · L1

scripts/serve.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/serve.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-22json

1{

2 "name": "@henri-ralmeida/prumo",

3 "version": "1.3.8",

4 "description": "Evidence-driven task orchestration with PO First for Claude Code, Kiro and Codex",

5 "type": "module",

6 "bin": { "prumo": "bin/prumo.mjs" },

7 "engines": { "node": ">=22" },

8 "license": "MIT",

9 "author": "Henrique Almeida",

10 "repository": { "type": "git", "url": "git+https://github.com/henri-ralmeida/prumo.git" },

11 "homepage": "https://github.com/henri-ralmeida/prumo#readme",

12 "bugs": "https://github.com/henri-ralmeida/prumo/issues",

13 "keywords": ["agent-skills", "claude-code", "kiro", "codex", "orchestration", "po-first"],

14 "files": ["bin/", "lib/", "scripts/*.mjs", "!scripts/*.test.mjs", "!scripts/*-smoke.mjs", "scripts/messages.json", "scripts/release-notes.json", "scripts/dashboard.html", "references/", "SKILL.md", "README.md", "README.pt-BR.md", "CHANGELOG.md", "LICENSE"],

15 "scripts": {

16 "test": "node --test scripts/*.test.mjs test/*.test.mjs",

17 "check": "node scripts/check-package.mjs",

18 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepack": "node scripts/check-package.mjs"

20 }

21}

22

lib/autostart.mjsView file

Lines 1-21javascript

1import { execFileSync, spawn, spawnSync } from 'node:child_process'

2import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs'

3import { createServer } from 'node:net'

4import { homedir } from 'node:os'

High

Trigger Reachable Persistence

lib/install.mjsView file

Lines 1-21javascript

1import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, lstatSync, renameSync, unlinkSync, rmdirSync, cpSync, statSync, accessSync, constants } from 'node:fs'

2import { homedir } from 'node:os'

3import { resolve, dirname, join, relative, sep, isAbsolute, delimiter } from 'node:path'

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

lib/install.mjsView on unpkg · L1

4

scripts/serve.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/serve.mjs#virtual:normalized:round1View on unpkg