Loading npm security reports…

@hunpeolabs/ai-agent-kit@1.2.0: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 1.2.0

@hunpeolabs/ai-agent-kit@1.2.0

The governed agent operating system for recoverable decisions, traceable runs, trusted plugins, and evidence-backed coding workflows.

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall automatically bootstraps governance assets into the consuming repository. The bootstrap selects all agent adapters by default and writes behavior-bearing agent configuration, including MCP configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of the package in a project

Impact

Alters instruction, skill, and MCP-control files for multiple AI-agent platforms without an explicit user command.

Mechanism

unconsented postinstall bootstrap of broad AI-agent control surfaces

Policy narrative

On installation, the lifecycle hook calls bootstrap with non-interactive approval flags. Adapter selection defaults to all registered platforms, then bootstrap writes scaffold files and managed instruction sections into the target repository. These include broad AI-agent configuration directories and a shipped MCP configuration, creating or modifying foreign agent control surfaces without an explicit user setup action.

Rationale

This is concrete install-time mutation of broad, foreign AI-agent control surfaces. It meets the blocking policy despite no observed credential exfiltration or remote payload download.

Evidence

package.jsondist/src/postinstall.mjsdist/src/adapters.mjsdist/src/bootstrap.mjsdist/src/paths.mjsassets/enterprise-ai-agent-os/.mcp.jsonAGENTS.mdCLAUDE.mdGEMINI.md.ai/

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli.mjsView file

1Install-time code directly mutates a foreign AI-agent control surface: L830: case "--agents": L831: options.agents = argv[++index]; L832: if (!options.agents) throw new Error("--agents requires a comma-separated list or all"); L833: break; L834: case "--claude-only": L835: options.claudeOnly = true; L836: break; L837: case "--codex-only": L838: options.codexOnly = true; L839: break; ... L852: L853: if (options.claudeOnly && options.codexOnly) { Write operation from dist/src/file-ops.mjs: L6: export function ensureParent(filePath) { L7: fs.mkdirSync(path.dirname(filePath), { recursive: true }); L8: } ... L32: if (options.createDirectories !== false) { L33: fs.mkdirSync(txRoot, { recursive: true }); L34: fs.mkdirSync(backupRoot, { recursive: true }); L35: } ... L61: const serializable = { .

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/cli.mjsView on unpkg · L1

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.0.1 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.0.1 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 67-99json

67 "CONTRIBUTING.md",

68 "LICENSE",

69 "README.md",

70 "SECURITY.md"

71 ],

72 "scripts": {

73 "check": "npm run lint && npm run typecheck && npm test && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run eval:routing && npm run conformance:adapters && npm run evidence:verify && npm run security:supply-chain && npm run build && npm run smoke:packed",

74 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

75 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

76 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

77 "eval:routing": "node bin/ai-agent-kit.mjs skills eval --config assets/enterprise-ai-agent-os/.ai/config/skill-routing.json --skills-root assets/enterprise-ai-agent-os/.ai/skills-src --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/skill-routing-cases.json",

78 "evidence:verify": "node scripts/verify-release-evidence.mjs",

79 "conformance:adapters": "node scripts/adapter-conformance.mjs",

80 "lint": "node scripts/lint.mjs",

81 "typecheck": "node scripts/typecheck.mjs",

82 "test": "node --test",

83 "build": "node scripts/build.mjs",

84 "smoke:packed": "node scripts/smoke-packed.mjs",

85 "release:dry-run": "npm pack --dry-run",

86 "security:supply-chain": "node scripts/supply-chain-check.mjs",

87 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L87

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L87

88 "prepack": "npm run build"

89 },

90 "engines": {

91 "node": ">=20"

92 },

93 "license": "MIT",

94 "publishConfig": {

95 "access": "public",

96 "registry": "https://registry.npmjs.org/"

97 }

98}

99

dist/src/cli.mjsView file

Lines 1-21javascript

1import { bootstrap } from "./bootstrap.mjs";

2import { ADAPTER_IDS, resolveAdapterIds } from "./adapters.mjs";

3import { capabilityMatrix, evaluateAdapterConformance, loadAdapterRegistry } from "./adapter-sdk.mjs";

4import { evaluateStandardsConformance } from "./standards-conformance.mjs"

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.0.1 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.0.1 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg