Loading npm security reports…

@hunpeolabs/ai-agent-kit@0.9.0: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 0.9.0

@hunpeolabs/ai-agent-kit@0.9.0

Governed cross-agent coding workflows with repository intelligence, quality profiles, approval gates, and evidence.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically imports a governed agent kit into the consuming repository. It mutates broad multi-vendor AI-agent instruction, skill, and configuration surfaces without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install in a project that depends on the package

Impact

Unconsented control of repository AI-agent behavior across installed tool surfaces.

Mechanism

postinstall auto-bootstrap of all AI-agent adapters

Policy narrative

On installation, the postinstall handler detects a project dependency and calls bootstrap non-interactively with automatic confirmation. Because no adapter selection is supplied, bootstrap selects every registered adapter and writes package-provided instructions and skills into numerous third-party AI-agent control surfaces in the consumer repository.

Rationale

This is a concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. Safeguards against source-code changes and exfiltration do not remove that control-hijack behavior.

Evidence

package.jsondist/src/postinstall.mjsdist/src/bootstrap.mjsdist/src/file-ops.mjsassets/enterprise-ai-agent-os/.ai/adapters/registry.jsondist/bin/postinstall.mjsdist/src/paths.mjsAGENTS.mdCLAUDE.mdGEMINI.mdCONVENTIONS.md.aider.conf.yml

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/bootstrap.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L200: git status L201: git diff -- AGENTS.md CLAUDE.md GEMINI.md CONVENTIONS.md .aider.conf.yml AI_AGENT_TEAM_GUIDE.md .ai .agents .claude .codex .github .cursor .windsurf .amazonq .junie .cline .clineru... L202: ... L204: L205: git add AGENTS.md CLAUDE.md GEMINI.md CONVENTIONS.md .aider.conf.yml AI_AGENT_TEAM_GUIDE.md .ai .agents .claude .codex .github .cursor .windsurf .amazonq .junie .cline .clinerules ... L206: ... L275: for (const [rel, content] of scaffoldFiles) { L276: if (["AGENTS.md", "CLAUDE.md", "GEMINI.md", "CONVENTIONS.md"].includes(rel)) continue; L277: writeConfigFile(root, transaction, rel, content, { generatedOnly: true }); L278: } L279: for (const rel of ["AGENTS.md", "CLAUDE.md", "GEMINI.md", "CONV

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/bootstrap.mjsView on unpkg · L1

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 64-96json

64 "docs/",

65 "CHANGELOG.md",

66 "CONTRIBUTING.md",

67 "LICENSE",

68 "README.md",

69 "SECURITY.md"

70 ],

71 "scripts": {

72 "check": "npm run lint && npm run typecheck && npm test && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run conformance:adapters && npm run security:supply-chain && npm run build && npm run smoke:packed",

73 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

74 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

75 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

76 "conformance:adapters": "node scripts/adapter-conformance.mjs",

77 "lint": "node scripts/lint.mjs",

78 "typecheck": "node scripts/typecheck.mjs",

79 "test": "node --test",

80 "build": "node scripts/build.mjs",

81 "smoke:packed": "node scripts/smoke-packed.mjs",

82 "release:dry-run": "npm pack --dry-run",

83 "security:supply-chain": "node scripts/supply-chain-check.mjs",

84 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L84

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L84

85 "prepack": "npm run build"

86 },

87 "engines": {

88 "node": ">=20"

89 },

90 "license": "MIT",

91 "publishConfig": {

92 "access": "public",

93 "registry": "https://registry.npmjs.org/"

94 }

95}

96

dist/src/bootstrap.mjsView file

Lines 1-21javascript

1import fs from "node:fs";

2import path from "node:path";

3import crypto from "node:crypto";

4import {

5 ADAPTERS,

6

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg