Loading npm security reports…

@hunpeolabs/ai-agent-kit@0.5.0: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 0.5.0

@hunpeolabs/ai-agent-kit@0.5.0

Governed cross-agent coding workflows with repository intelligence, quality profiles, approval gates, and evidence.

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package as a project dependency automatically imports an AI-agent kit into the host repository. It mutates broad, cross-vendor agent instruction and configuration surfaces without an explicit bootstrap command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of the package in a Git project

Impact

Host AI coding agents can receive package-authored instructions and skills.

Mechanism

postinstall-driven bootstrap writes cross-agent control files

Policy narrative

The postinstall hook detects a project install and invokes non-interactive bootstrap with the governed preset. Bootstrap defaults to all adapters and writes managed content into repository-level instructions and multiple AI-agent configuration/skill directories. This is an unconsented install-time mutation of a broad foreign AI-agent control surface.

Rationale

Source confirms the prohibited chain directly: npm postinstall invokes a non-interactive bootstrap that writes cross-vendor AI-agent controls in the consuming project. No exfiltration is required for this concrete install-time control-surface mutation.

Evidence

package.jsondist/bin/postinstall.mjsdist/src/postinstall.mjsdist/src/bootstrap.mjsdist/src/adapters.mjsdist/src/paths.mjsREADME.mdAGENTS.mdCLAUDE.mdGEMINI.mdCONVENTIONS.md.agents/

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/adapters.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L4: label: "Claude Code", L5: exactPaths: ["CLAUDE.md"], L6: pathPrefixes: [".claude/"], L7: skillRoots: [".claude/skills"] L8: }, ... L11: label: "OpenAI Codex", L12: exactPaths: ["AGENTS.md"], L13: pathPrefixes: [".codex/"], L14: skillRoots: [".agents/skills"], L15: sharedSkillRoots: [".agents/skills"] L16: }, ... L19: label: "GitHub Copilot", Write operation from dist/src/file-ops.mjs: L6: export function ensureParent(filePath) { L7: fs.mkdirSync(path.dirname(filePath), { recursive: true }); L8: } ... L32: if (options.createDirectories !== false) { L33: fs.mkdirSync(txRoot, { recursive: true }); L34: fs.mkdirSync(backupRoot, { recursive: true }); L35: } ... L61: const serializable = { ...transaction, touched: [...tra

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/adapters.mjsView on unpkg · L1

assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.pyView file

•path = assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.py kind = payload_in_excluded_dir sizeBytes = 3058 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.py kind = build_helper sizeBytes = 3058 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.pyView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 48-80json

48 "assets/",

49 "dist/bin/",

50 "dist/src/",

51 "dist/sbom.spdx.json",

52 "docs/",

53 "CHANGELOG.md",

54 "CONTRIBUTING.md",

55 "LICENSE",

56 "README.md",

57 "SECURITY.md"

58 ],

59 "scripts": {

60 "check": "npm run lint && npm run typecheck && npm test && npm run security:supply-chain && npm run build && npm run smoke:packed",

61 "lint": "node scripts/lint.mjs",

62 "typecheck": "node scripts/typecheck.mjs",

63 "test": "node --test",

64 "build": "node scripts/build.mjs",

65 "smoke:packed": "node scripts/smoke-packed.mjs",

66 "release:dry-run": "npm pack --dry-run",

67 "security:supply-chain": "node scripts/supply-chain-check.mjs",

68 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L68

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L68

69 "prepack": "npm run build"

70 },

71 "engines": {

72 "node": ">=20"

73 },

74 "license": "MIT",

75 "publishConfig": {

76 "access": "public",

77 "registry": "https://registry.npmjs.org/"

78 }

79}

80

dist/src/adapters.mjsView file

Lines 1-21javascript

1const DEFINITIONS = [

2 {

3 id: "claude",

4 label: "Claude Code",

5 exactPaths: ["CLAUDE.md"],

6 pathPrefixes: [".claude/"],

7

assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.pyView file

•path = assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.py kind = payload_in_excluded_dir sizeBytes = 3058 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.py kind = build_helper sizeBytes = 3058 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.ai/scripts/enforce_command_policy.pyView on unpkg