Loading npm security reports…

@hunpeolabs/ai-agent-kit@1.6.0: AI-agent control-surface risk | LPM Firewall

registry / @hunpeolabs/ai-agent-kit / 1.6.0

@hunpeolabs/ai-agent-kit@1.6.0

The governed agent operating system that turns rough product ideas into approved requirements, specifications, delivery, and evidence-backed software.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package as a project dependency triggers a non-interactive bootstrap in the consuming repository. It writes AI-agent configuration and skills across default adapters without a user command or approval.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during a project installation

Impact

Changes behavior-bearing project AI-agent files, including .claude and adapter skill roots.

Mechanism

automatic bootstrap writes AI-agent control-surface configuration

Policy narrative

On npm installation, postinstall calls bootstrap against INIT_CWD with non-interactive approval. With no adapter selection supplied, the bootstrap selects all registered adapters and writes generated skills/configuration into the consuming repository, including Claude control files. This is unconsented install-time mutation of a broad, foreign AI-agent control surface.

Rationale

The package performs behavior-bearing cross-agent configuration writes during postinstall without an explicit user command. This meets the install-control-surface blocking boundary despite no observed exfiltration.

Evidence

package.jsondist/bin/postinstall.mjsdist/src/postinstall.mjsdist/src/adapters.mjsdist/src/bootstrap.mjsdist/src/templates.mjsdist/src/file-ops.mjs<install project>/.claude/settings.json<install project>/.claude/commands/start-task.md

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/bin/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src/cli.mjsView file

695Install-time code directly mutates a foreign AI-agent control surface: L695: const content = withMemoryStore(options, (store) => store.exportEntries(options)); L696: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, content, { mode: 0o600 }); L697: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), sha256: crypto.createHash("sha256").update(content).digest("hex") }; ... L710: const { artifact: output, relative } = resolveMemoryArtifactPath(options, options.output, "memory pack output"); L711: fs.mkdirSync(path.dirname(output), { recursive: true }); fs.writeFileSync(output, `${JSON.stringify(pack, null, 2)}\n`, { mode: 0o600 }); L712: return { schema_version: 1, status: "EXPORTED", output: relative.replaceAll("\\", "/"), e

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/src/cli.mjsView on unpkg · L695

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/memory-contract.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/memory-contract.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-contract.mjsView on unpkg

dist/src/memory-lifecycle.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/memory-lifecycle.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-lifecycle.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

dist/src/pulse-reporters.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/pulse-reporters.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/pulse-reporters.mjsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 77-112json

77 "scripts": {

78 "check": "npm run lint && npm run typecheck && npm test && npm run validate:capabilities && npm run eval:pulse && npm run eval:gate && npm run eval:system-design && npm run eval:team && npm run eval:routing && npm run eval:memory && npm run conformance:adapters && npm run evidence:verify && npm run security:supply-chain && npm run build && npm run smoke:packed",

79 "validate:capabilities": "python3 assets/enterprise-ai-agent-os/.ai/scripts/validate_capability_coverage.py --root assets/enterprise-ai-agent-os/.ai",

80 "eval:pulse": "node scripts/pulse-benchmark.mjs",

81 "eval:gate": "node bin/ai-agent-kit.mjs eval gate --baseline test/fixtures/v070/eval-pass.json --candidate test/fixtures/v070/eval-pass.json",

82 "eval:system-design": "node bin/ai-agent-kit.mjs architecture eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/system-design-pass.json",

83 "eval:team": "node bin/ai-agent-kit.mjs team eval --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/team-orchestration-cases.json",

84 "eval:routing": "node bin/ai-agent-kit.mjs skills eval --config assets/enterprise-ai-agent-os/.ai/config/skill-routing.json --skills-root assets/enterprise-ai-agent-os/.ai/skills-src --fixture assets/enterprise-ai-agent-os/.ai/evals/e2e/skill-routing-cases.json",

85 "eval:product": "node --test test/v160-product-genesis.test.mjs test/v160-product-genesis-runtime.test.mjs test/v160-product-genesis-cli.test.mjs",

86 "benchmark:product": "node scripts/product-genesis-benchmark.mjs --iterations 100",

87 "eval:memory": "node bin/ai-agent-kit.mjs runtime memory eval --file test/fixtures/v130/memory-eval-pass.json",

88 "evidence:verify": "node scripts/verify-release-evidence.mjs",

89 "conformance:adapters": "node scripts/adapter-conformance.mjs",

90 "lint": "node scripts/lint.mjs",

91 "typecheck": "node scripts/typecheck.mjs",

92 "test": "node --test",

93 "build": "node scripts/build.mjs",

94 "smoke:packed": "node scripts/smoke-packed.mjs",

95 "release:dry-run": "npm pack --dry-run",

96 "security:supply-chain": "node scripts/supply-chain-check.mjs",

97 "postinstall": "node dist/bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L97

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L97

98 "prepack": "npm run build"

99 },

100 "engines": {

101 "node": ">=20"

102 },

103 "license": "MIT",

104 "publishConfig": {

105 "access": "public",

106 "registry": "https://registry.npmjs.org/"

107 },

108 "dependencies": {

109 "better-sqlite3": "12.11.1"

110 }

111}

112

dist/src/cli.mjsView file

Lines 675-715javascript

675 });

676 }

677 if (area === "evidence" && action === "verify") return verifyEvidence(options);

678 if (area ===

dist/src/templates.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. rieval. verify critical behavior against source code. `); files.set(".ai/skills-src/start-task/skill.md", `--- name: start-task description: convert a request into an indexed engineering task contract before editing. --- # start task use the repository-intelligence skill first. return indexed facts, source-code verified facts, assumptions, risk, smallest safe change, test strategy, and approval needs. `); files.set(".ai/skills-src/implement-feature/skill.md", `--- name: implement-feature description: implement an explicitly approved scoped change without expanding scope. --- # implement feature use repository-intelligence first. verify approval evidence before protecte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/src/templates.mjsView on unpkg

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView file

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = payload_in_excluded_dir sizeBytes = 6250 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

•path = assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.py kind = build_helper sizeBytes = 6250 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/enterprise-ai-agent-os/.cursor/skills/design-scalable-systems/scripts/capacity_cost_model.pyView on unpkg

dist/src/change-passport.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/change-passport.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/change-passport.mjsView on unpkg

dist/src/memory-contract.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/memory-contract.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-contract.mjsView on unpkg

dist/src/memory-lifecycle.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/memory-lifecycle.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/memory-lifecycle.mjsView on unpkg

dist/src/proof-replay.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/proof-replay.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/proof-replay.mjsView on unpkg

dist/src/pulse-reporters.mjsView file

•matchType = normalized_sha256 matchedPackage = @hunpeolabs/ai-agent-kit@1.5.0 matchedPath = dist/src/pulse-reporters.mjs matchedIdentity = npm:[redacted]:1.5.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/src/pulse-reporters.mjsView on unpkg