Loading npm security reports…

@hunpeolabs/ai-agent-kit@1.4.0: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 1.4.0

@hunpeolabs/ai-agent-kit@1.4.0

Performance and assurance harness for AI coding agents with repository intelligence, native architecture pulse, governed memory, security gates, and verifiable delivery.

AI Security Review

scanned 11h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Install-time code imports a governed kit into the consumer project and writes AI-agent configuration. This mutates shared and third-party agent control surfaces without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during a qualifying project install

Impact

Project AI-agent behavior is altered through AGENTS.md, CLAUDE.md, .agents, and .claude.

Mechanism

non-interactive bootstrap writes generated agent instructions and skills

Policy narrative

Installing the package triggers postinstall, which calls bootstrap with --non-interactive and --yes against the installation project. Bootstrap writes scaffolded configuration and synchronizes skills into selected agent roots; generated templates explicitly target .agents and .claude. This changes broad AI-agent control surfaces without a user-invoked setup command.

Rationale

The confirmed lifecycle path performs unconsented install-time mutation of foreign/broad AI-agent control surfaces. The lack of observed exfiltration does not remove that concrete install-time control-hijack behavior.

Evidence

package.jsondist/bin/postinstall.mjsdist/src/postinstall.mjsdist/src/bootstrap.mjsdist/src/templates.mjsAGENTS.mdCLAUDE.md.ai/.agents/skills/.claude/skills/.ai-agent-kit/

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli.mjsView file

589Install-time code directly mutates a foreign AI-agent control surface: L589: const content = withMemoryStore(options, (store) => store.exportEntries(options)); L590: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, content, { mode: 0o600 }); L591: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), sha256: crypto.createHash("sha256").update(content).digest("hex") }; ... L604: const { artifact: output, relative } = resolveMemoryArtifactPath(options, options.output, "memory pack output"); L605: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, `${JSON.stringify(pack, null, 2)}\n`, { mode: 0o600 }); L606: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/cli.mjsView on unpkg · L589

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/memory-contract.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.3.0 matchedPath = dist/src/memory-contract.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-contract.mjsView on unpkg

dist/src/memory-lifecycle.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.3.0 matchedPath = dist/src/memory-lifecycle.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-lifecycle.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.3.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 72-107json

72 "LICENSE",

73 "README.md",

74 "SECURITY.md"

75 ],

76 "scripts": {

77 "check": "npm run lint && npm run typecheck && npm test && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run eval:routing && npm run eval:memory && npm run conformance:adapters && npm run evidence:verify && npm run security:supply-chain && npm run build && npm run smoke:packed",

78 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

79 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

80 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

81 "eval:routing": "node bin/ai-agent-kit.mjs skills eval --config assets/enterprise-ai-agent-os/.ai/config/skill-routing.json --skills-root assets/enterprise-ai-agent-os/.ai/skills-src --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/skill-routing-cases.json",

82 "eval:memory": "node bin/ai-agent-kit.mjs runtime memory eval --file test/fixtures/v130/memory-eval-pass.json",

83 "evidence:verify": "node scripts/verify-release-evidence.mjs",

84 "conformance:adapters": "node scripts/adapter-conformance.mjs",

85 "lint": "node scripts/lint.mjs",

86 "typecheck": "node scripts/typecheck.mjs",

87 "test": "node --test",

88 "build": "node scripts/build.mjs",

89 "smoke:packed": "node scripts/smoke-packed.mjs",

90 "release:dry-run": "npm pack --dry-run",

91 "security:supply-chain": "node scripts/supply-chain-check.mjs",

92 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L92

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L92

93 "prepack": "npm run build"

94 },

95 "engines": {

96 "node": ">=20"

97 },

98 "license": "MIT",

99 "publishConfig": {

100 "access": "public",

101 "registry": "https://registry.npmjs.org/"

102 },

103 "dependencies": {

104 "better-sqlite3": "12.11.1"

105 }

106}

107

dist/src/cli.mjsView file

Lines 569-609javascript

569 });

570 }

571 if (area === "evidence" && action === "verify") return verifyEvidence(options);

572 if (area ===

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/memory-contract.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.3.0 matchedPath = dist/src/memory-contract.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-contract.mjsView on unpkg

dist/src/memory-lifecycle.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.3.0 matchedPath = dist/src/memory-lifecycle.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-lifecycle.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.3.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg