Loading npm security reports…

@iliasalmerekov/aegis@0.6.11: Malicious npm security report | LPM Firewall

registry / @iliasalmerekov/aegis / 0.6.11

@iliasalmerekov/aegis@0.6.11

Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations

AI Security Review

scanned 11d ago · by lpm-firewall-ai

An npm postinstall hook automatically runs a downloaded binary to install hooks into pre-existing Claude Code or Codex control surfaces. This is an unconsented lifecycle mutation of foreign AI-agent configuration.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package through npm on a supported platform when either agent directory exists.

Impact

The package can alter AI-agent command-execution controls without the user explicitly running setup.

Mechanism

The installer downloads and activates a vendor binary, detects the agent directories, and runs its all-hooks installation command.

Attack narrative

Npm automatically launches the installer. On hosts with Claude Code or Codex directories, it downloads a binary and immediately asks that binary to install hooks for all supported agents. The user has not supplied an explicit hook-setup command; avoiding the action requires knowing and setting an opt-out environment variable. This creates an unconsented install-time mutation path into foreign AI-agent control surfaces.

AI rationale

The automatic postinstall hook invokes all-agent hook installation when it finds existing foreign agent directories. Under the install-control-surface policy, this is concrete install-hook abuse even though the binary download is checksum-verified.

Evidence

package.jsonscripts/install.jsvendor/aegis~/.claude~/.codex

Network endpoints1

/IliasAlmerekov/aegis-shellguard/releases/download/v0.6.11

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L11: const vendorDir = path.join(packageRoot, "vendor"); L12: const binaryPath = path.join(vendorDir, "aegis"); L13: const checksumsPath = path.join(packageRoot, "checksums.json"); ... L29: L30: // Binary-only install: never edit shell startup files here. Point users at the L31: // explicit opt-in `aegis setup-shell` command so enabling the shell proxy is a

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/aegis.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/aegis.jsView on unpkg · L3

scripts/install.jsView file

60L61: const claudeDir = path.join(home, ".claude"); L62: const codexDir = path.join(home, ".codex"); L63: const hasAgentDir = fs.existsSync(claudeDir) || fs.existsSync(codexDir); ... L169: L170: fs.mkdirSync(vendorDir, { recursive: true }); L171: L172: if (process.env.AEGIS_NPM_SKIP_DOWNLOAD === "1") { L173: fs.writeFileSync(binaryPath, "#!/bin/sh\nprintf 'aegis test binary\\n'\n", { mode: 0o755 }); L174: printNextSteps();

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L60

4const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L14: L15: const platform = process.env.AEGIS_NPM_PLATFORM || process.platform; L16: const arch = process.env.AEGIS_NPM_ARCH || process.arch;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @iliasalmerekov/aegis@0.6.10 matchedPath = scripts/install.js matchedIdentity = npm:QGlsaWFzYWxtZXJla292L2FlZ2lz:0.6.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity