Loading npm security reports…

@hunpeolabs/ai-agent-kit@1.0.1: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 1.0.1

@hunpeolabs/ai-agent-kit@1.0.1

Performance and assurance harness for AI coding agents with repository intelligence, portable skills, governed memory, specialist coordination, security gates, and verifiable delivery.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically bootstraps a governed AI-agent kit into the consuming repository. It writes managed agent configuration and copies skills into multiple agent control surfaces.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of the package as a top-level project dependency

Impact

Unconsented mutation of broad project AI-agent instruction and skill surfaces.

Mechanism

postinstall invokes non-interactive bootstrap that writes project AI-agent configuration

Policy narrative

During npm install, postinstall selects the project target and invokes bootstrap with --non-interactive and --yes. Bootstrap writes generated project configuration, managed instruction files, and agent skills; the generated synchronization script copies skills into both .agents and .claude. This is an unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

The package performs a concrete, automatic postinstall write chain into the consuming project's AI-agent configuration rather than requiring an explicit user command. This meets the blocking policy for unconsented install-time mutation of a foreign/broad AI-agent control surface.

Evidence

package.jsondist/src/postinstall.mjsdist/src/bootstrap.mjsdist/src/templates.mjsAGENTS.mdCLAUDE.mdGEMINI.mdCONVENTIONS.md.gitignore.ai/.agents/skills/

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L761: case "--agents": L762: options.agents = argv[++index]; L763: if (!options.agents) throw new Error("--agents requires a comma-separated list or all"); L764: break; L765: case "--claude-only": L766: options.claudeOnly = true; L767: break; L768: case "--codex-only": L769: options.codexOnly = true; L770: break; ... L783: L784: if (options.claudeOnly && options.codexOnly) { Write operation from dist/src/file-ops.mjs: L6: export function ensureParent(filePath) { L7: fs.mkdirSync(path.dirname(filePath), { recursive: true }); L8: } ... L32: if (options.createDirectories !== false) { L33: fs.mkdirSync(txRoot, { recursive: true }); L34: fs.mkdirSync(backupRoot, { recursive: true }); L35: } ... L61: const serializable = { .

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/cli.mjsView on unpkg · L1

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@0.9.1 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:0.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 64-96json

64 "docs/",

65 "CHANGELOG.md",

66 "CONTRIBUTING.md",

67 "LICENSE",

68 "README.md",

69 "SECURITY.md"

70 ],

71 "scripts": {

72 "check": "npm run lint && npm run typecheck && npm test && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run conformance:adapters && npm run security:supply-chain && npm run build && npm run smoke:packed",

73 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

74 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

75 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

76 "conformance:adapters": "node scripts/adapter-conformance.mjs",

77 "lint": "node scripts/lint.mjs",

78 "typecheck": "node scripts/typecheck.mjs",

79 "test": "node --test",

80 "build": "node scripts/build.mjs",

81 "smoke:packed": "node scripts/smoke-packed.mjs",

82 "release:dry-run": "npm pack --dry-run",

83 "security:supply-chain": "node scripts/supply-chain-check.mjs",

84 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L84

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L84

85 "prepack": "npm run build"

86 },

87 "engines": {

88 "node": ">=20"

89 },

90 "license": "MIT",

91 "publishConfig": {

92 "access": "public",

93 "registry": "https://registry.npmjs.org/"

94 }

95}

96

dist/src/cli.mjsView file

Lines 1-21javascript

1import { bootstrap } from "./bootstrap.mjs";

2import { ADAPTER_IDS, resolveAdapterIds } from "./adapters.mjs";

3import { capabilityMatrix, evaluateAdapterConformance, loadAdapterRegistry } from "./adapter-sdk.mjs";

4import { evaluateStandardsConformance } from "./standards-conformance.mjs"

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@0.9.1 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:0.9.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg