registry / Install hook abuse / @iliasalmerekov/aegis
@iliasalmerekov/aegis
Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations
This report shows the evidence for @iliasalmerekov/aegis@0.6.11. 8 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe automatic postinstall hook invokes all-agent hook installation when it finds existing foreign agent directories. Under the install-control-surface policy, this is concrete install-hook abuse even though the binary download is checksum-verified.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing the package through npm on a supported platform when either agent directory exists.
Impact
The package can alter AI-agent command-execution controls without the user explicitly running setup.
Mechanism
The installer downloads and activates a vendor binary, detects the agent directories, and runs its all-hooks installation command.
Attack narrative
Npm automatically launches the installer. On hosts with Claude Code or Codex directories, it downloads a binary and immediately asks that binary to install hooks for all supported agents. The user has not supplied an explicit hook-setup command; avoiding the action requires knowing and setting an opt-out environment variable. This creates an unconsented install-time mutation path into foreign AI-agent control surfaces.
AI rationale
The automatic postinstall hook invokes all-agent hook installation when it finds existing foreign agent directories. Under the install-control-surface policy, this is concrete install-hook abuse even though the binary download is checksum-verified.
Evidence
package.jsonscripts/install.jsvendor/aegis~/.claude~/.codex
Network endpoints1
github.com/IliasAlmerekov/aegis-shellguard/releases/download/v0.6.11
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs its installer automatically after npm installation.
- The installer detects existing Claude Code or Codex configuration directories and invokes an all-hooks installation command without an affirmative setup command.
- The installer downloads a platform binary, verifies its checksum, then makes it executable before invoking hook setup.
Evidence against
- The downloaded binary is checked against package-supplied SHA-256 values.
- An environment variable can disable hook setup, but it is not the default.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg4scripts.postinstall = node scripts/install.js
Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution.
L4: const fs = require("node:fs");
L5: const https = require("node:https");
L6: const os = require("node:os");
L7: const path = require("node:path");
L8: const { spawnSync } = require("node:child_process");
L9:
...
L11: const vendorDir = path.join(packageRoot, "vendor");
L12: const binaryPath = path.join(vendorDir, "aegis");
L13: const checksumsPath = path.join(packageRoot, "checksums.json");
...
L29:
L30: // Binary-only install: never edit shell startup files here. Point users at the
L31: // explicit opt-in `aegis setup-shell` command so enabling the shell proxy is a
High
Unverified Remote Native Payload Install
Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.
package.jsonView on unpkg · L4•scripts.postinstall = node scripts/install.js
Medium
Findings
1 Critical6 High4 Medium3 Low
CriticalAi Agent Control Hijackscripts/install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/aegis.js
HighSame File Env Network Executionscripts/install.js
HighUnverified Remote Native Payload Installpackage.json
HighKnown Malware Source Similarityscripts/install.js
HighKnown Malware Source Fingerprint Signaturescripts/install.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @iliasalmerekov/aegis@0.6.11.
The versions list below shows the verdict for each recorded version.
- Avoid installing @iliasalmerekov/aegis@0.6.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
8 known versions0.6.11latestshownMaliciousInstall Hook AbuseBlockPublishedSep 27, 2026, 7:10 PM0.6.10MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 25, 2026, 11:03 AM0.6.8MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 23, 2026, 12:39 PM0.6.7MaliciousSoft block: AI-agent control surfaceBlockPublished