Loading npm security reports…

@iliasalmerekov/aegis@0.6.10: AI-agent control-surface risk | LPM Firewall

registry / @iliasalmerekov/aegis / 0.6.10

@iliasalmerekov/aegis@0.6.10

Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations

AI Security Review

scanned 12d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, postinstall downloads the Aegis release binary and, if a Claude Code or Codex home directory already exists, runs it with install-hooks --all. That writes into foreign agent control surfaces without an install-time consent prompt.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install lifecycle postinstall, when the user home already contains .claude or .codex and AEGIS_NPM_SKIP_HOOKS is not 1.

Impact

Existing Claude Code and Codex configurations can be modified during package install by an opaque binary the user did not invoke.

Mechanism

scripts/install.js downloads the platform binary, verifies its checksum, chmod 0755, then spawnSync(binary, ["install-hooks", "--all"]).

Policy narrative

Installing @iliasalmerekov/aegis@0.6.10 runs scripts/install.js from postinstall. The script downloads a GitHub release binary into vendor/aegis, checks SHA256, and makes it executable. If ~/.claude or ~/.codex exists, it immediately executes that binary with install-hooks --all. Skipping requires a pre-set environment variable. The hook payload itself is not in the JavaScript, so install mutates foreign agent configs through an opaque binary without a consent prompt.

AI rationale

Postinstall unconditionally launches a downloaded binary that installs hooks into existing Claude Code and Codex directories, which is an unconsented mutation of foreign agent control surfaces. An environment opt-out and a checksum do not supply user consent for that install-time write.

Evidence

package.jsonscripts/install.jsvendor/aegis~/.claude

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L11: const vendorDir = path.join(packageRoot, "vendor"); L12: const binaryPath = path.join(vendorDir, "aegis"); L13: const checksumsPath = path.join(packageRoot, "checksums.json"); ... L29: L30: // Binary-only install: never edit shell startup files here. Point users at the L31: // explicit opt-in `aegis setup-shell` command so enabling the shell proxy is a

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/aegis.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/aegis.jsView on unpkg · L3

scripts/install.jsView file

60L61: const claudeDir = path.join(home, ".claude"); L62: const codexDir = path.join(home, ".codex"); L63: const hasAgentDir = fs.existsSync(claudeDir) || fs.existsSync(codexDir); ... L169: L170: fs.mkdirSync(vendorDir, { recursive: true }); L171: L172: if (process.env.AEGIS_NPM_SKIP_DOWNLOAD === "1") { L173: fs.writeFileSync(binaryPath, "#!/bin/sh\nprintf 'aegis test binary\\n'\n", { mode: 0o755 }); L174: printNextSteps();

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L60

4const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L14: L15: const platform = process.env.AEGIS_NPM_PLATFORM || process.platform; L16: const arch = process.env.AEGIS_NPM_ARCH || process.arch;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @iliasalmerekov/aegis@0.6.7 matchedPath = scripts/install.js matchedIdentity = npm:QGlsaWFzYWxtZXJla292L2FlZ2lz:0.6.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity