Loading npm security reports…

@hunpeolabs/ai-agent-kit@1.3.0: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 1.3.0

@hunpeolabs/ai-agent-kit@1.3.0

The governed agent operating system for recoverable decisions, traceable runs, trusted plugins, and evidence-backed coding workflows.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On project installation, the package automatically bootstraps AI-agent configuration. It writes managed instructions and adapter assets across broad, foreign agent control surfaces.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm project install of the package

Impact

Changes AGENTS.md and agent-specific configuration/skill directories without an explicit setup command or approval.

Mechanism

postinstall-driven non-interactive AI-agent configuration injection

Policy narrative

Installing the package triggers postinstall, which runs bootstrap with --non-interactive and --yes against the consuming project. Bootstrap defaults to all adapters and writes managed root instruction files plus agent configuration and skills under multiple agent-owned paths. This is unconsented install-time mutation of broad AI-agent control surfaces.

Rationale

The lifecycle hook performs a concrete, automatic project mutation across foreign AI-agent control surfaces. This meets the block boundary despite the absence of credential theft or install-time networking.

Evidence

package.jsondist/src/postinstall.mjsdist/src/bootstrap.mjsdist/src/adapters.mjsdist/src/paths.mjsAGENTS.mdCLAUDE.mdGEMINI.mdCONVENTIONS.md.ai/.agents/.claude/.codex/

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli.mjsView file

572Install-time code directly mutates a foreign AI-agent control surface: L572: const content = withMemoryStore(options, (store) => store.exportEntries(options)); L573: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, content, { mode: 0o600 }); L574: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), sha256: crypto.createHash("sha256").update(content).digest("hex") }; ... L587: const { artifact: output, relative } = resolveMemoryArtifactPath(options, options.output, "memory pack output"); L588: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, `${JSON.stringify(pack, null, 2)}\n`, { mode: 0o600 }); L589: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/cli.mjsView on unpkg · L572

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.2.0 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.2.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 70-105json

70 "LICENSE",

71 "README.md",

72 "SECURITY.md"

73 ],

74 "scripts": {

75 "check": "npm run lint && npm run typecheck && npm test && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run eval:routing && npm run eval:memory && npm run conformance:adapters && npm run evidence:verify && npm run security:supply-chain && npm run build && npm run smoke:packed",

76 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

77 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

78 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

79 "eval:routing": "node bin/ai-agent-kit.mjs skills eval --config assets/enterprise-ai-agent-os/.ai/config/skill-routing.json --skills-root assets/enterprise-ai-agent-os/.ai/skills-src --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/skill-routing-cases.json",

80 "eval:memory": "node bin/ai-agent-kit.mjs runtime memory eval --file test/fixtures/v130/memory-eval-pass.json",

81 "evidence:verify": "node scripts/verify-release-evidence.mjs",

82 "conformance:adapters": "node scripts/adapter-conformance.mjs",

83 "lint": "node scripts/lint.mjs",

84 "typecheck": "node scripts/typecheck.mjs",

85 "test": "node --test",

86 "build": "node scripts/build.mjs",

87 "smoke:packed": "node scripts/smoke-packed.mjs",

88 "release:dry-run": "npm pack --dry-run",

89 "security:supply-chain": "node scripts/supply-chain-check.mjs",

90 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L90

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L90

91 "prepack": "npm run build"

92 },

93 "engines": {

94 "node": ">=20"

95 },

96 "license": "MIT",

97 "publishConfig": {

98 "access": "public",

99 "registry": "https://registry.npmjs.org/"

100 },

101 "dependencies": {

102 "better-sqlite3": "12.11.1"

103 }

104}

105

dist/src/cli.mjsView file

Lines 552-592javascript

552 });

553 }

554 if (area === "evidence" && action === "verify") return verifyEvidence(options);

555 if (area ===

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.2.0 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.2.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg