Loading npm security reports…

@hunpeolabs/ai-agent-kit@0.9.1: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 0.9.1

@hunpeolabs/ai-agent-kit@0.9.1

Governed AI agent orchestration with repository intelligence, approval gates, specialist workcells, and reviewable evidence.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently imports a large AI-agent scaffold into the consuming repository. It defaults to every supported third-party agent surface rather than requiring an explicit user command or adapter selection.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of the package as a project dependency or top-level install

Impact

Unconsented modification of foreign AI-agent control surfaces can influence future agent behavior in the project.

Mechanism

non-interactive bootstrap writes broad AI-agent instructions, hooks, rules, and skills

Policy narrative

Installing the package executes postinstall, which calls bootstrap with --non-interactive and --yes. Bootstrap defaults to all adapters and writes packaged content into multiple third-party AI-agent configuration and skill locations in the target repository, including .claude, .codex, .cursor, and .github, without an explicit setup command or adapter consent.

Rationale

This is a concrete unconsented install-time mutation of broad foreign AI-agent control surfaces. Guardrails and lack of observed exfiltration do not remove that attack surface.

Evidence

package.jsondist/bin/postinstall.mjsdist/src/postinstall.mjsdist/src/bootstrap.mjsdist/src/adapters.mjsassets/enterprise-ai-agent-os/.ai/adapters/registry.jsonAGENTS.mdCLAUDE.mdGEMINI.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/bootstrap.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L200: git status L201: git diff -- AGENTS.md CLAUDE.md GEMINI.md CONVENTIONS.md .aider.conf.yml AI_AGENT_TEAM_GUIDE.md .ai .agents .claude .codex .github .cursor .windsurf .amazonq .junie .cline .clineru... L202: ... L204: L205: git add AGENTS.md CLAUDE.md GEMINI.md CONVENTIONS.md .aider.conf.yml AI_AGENT_TEAM_GUIDE.md .ai .agents .claude .codex .github .cursor .windsurf .amazonq .junie .cline .clinerules ... L206: ... L275: for (const [rel, content] of scaffoldFiles) { L276: if (["AGENTS.md", "CLAUDE.md", "GEMINI.md", "CONVENTIONS.md"].includes(rel)) continue; L277: writeConfigFile(root, transaction, rel, content, { generatedOnly: true }); L278: } L279: for (const rel of ["AGENTS.md", "CLAUDE.md", "GEMINI.md", "CONV

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/bootstrap.mjsView on unpkg · L1

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@0.9.0 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@0.9.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 64-96json

64 "docs/",

65 "CHANGELOG.md",

66 "CONTRIBUTING.md",

67 "LICENSE",

68 "README.md",

69 "SECURITY.md"

70 ],

71 "scripts": {

72 "check": "npm run lint && npm run typecheck && npm test && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run conformance:adapters && npm run security:supply-chain && npm run build && npm run smoke:packed",

73 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

74 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

75 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

76 "conformance:adapters": "node scripts/adapter-conformance.mjs",

77 "lint": "node scripts/lint.mjs",

78 "typecheck": "node scripts/typecheck.mjs",

79 "test": "node --test",

80 "build": "node scripts/build.mjs",

81 "smoke:packed": "node scripts/smoke-packed.mjs",

82 "release:dry-run": "npm pack --dry-run",

83 "security:supply-chain": "node scripts/supply-chain-check.mjs",

84 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L84

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L84

85 "prepack": "npm run build"

86 },

87 "engines": {

88 "node": ">=20"

89 },

90 "license": "MIT",

91 "publishConfig": {

92 "access": "public",

93 "registry": "https://registry.npmjs.org/"

94 }

95}

96

dist/src/bootstrap.mjsView file

Lines 1-21javascript

1import fs from "node:fs";

2import path from "node:path";

3import crypto from "node:crypto";

4import {

5 ADAPTERS,

6

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@0.9.0 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@0.9.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:0.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg