Loading npm security reports…

@iliasalmerekov/aegis@0.6.3: AI-agent control-surface risk | LPM Firewall

registry / @iliasalmerekov/aegis / 0.6.3

@iliasalmerekov/aegis@0.6.3

Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads a native executable and, when Claude or Codex directories exist, invokes its all-agent hook installer without a separate user command. This mutates foreign AI-agent control surfaces through an opaque binary.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation on Linux/macOS where ~/.claude or ~/.codex exists

Impact

Hooks can intercept or alter Claude Code and Codex command-execution control flow.

Mechanism

postinstall native download followed by automatic all-agent hook installation

Policy narrative

Installing the package invokes scripts/install.js. It downloads a checksum-pinned native Aegis binary, then automatically runs `aegis install-hooks --all` if either existing Claude or Codex configuration directory is present. The package source does not expose the binary's exact writes, but its documented purpose is to install PreToolUse hooks into those foreign agent environments.

Rationale

The documented postinstall path automatically installs hooks across existing Claude Code/Codex environments, an unconsented foreign AI-agent control-surface mutation. Disclosure, opt-out support, and checksum verification do not remove that install-time behavior.

Evidence

package.jsonscripts/install.jsREADME.mdchecksums.jsonbin/aegis.jsvendor/aegis~/.claude~/.codex

Network endpoints

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L11: const vendorDir = path.join(packageRoot, "vendor"); L12: const binaryPath = path.join(vendorDir, "aegis"); L13: const checksumsPath = path.join(packageRoot, "checksums.json"); ... L29: L30: // Binary-only install: never edit shell startup files here. Point users at the L31: // explicit opt-in `aegis setup-shell` command so enabling the shell proxy is a

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/aegis.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/aegis.jsView on unpkg · L3

scripts/install.jsView file

60L61: const claudeDir = path.join(home, ".claude"); L62: const codexDir = path.join(home, ".codex"); L63: const hasAgentDir = fs.existsSync(claudeDir) || fs.existsSync(codexDir); ... L169: L170: fs.mkdirSync(vendorDir, { recursive: true }); L171: L172: if (process.env.AEGIS_NPM_SKIP_DOWNLOAD === "1") { L173: fs.writeFileSync(binaryPath, "#!/bin/sh\nprintf 'aegis test binary\\n'\n", { mode: 0o755 }); L174: printNextSteps();

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L60

4const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L14: L15: const platform = process.env.AEGIS_NPM_PLATFORM || process.platform; L16: const arch = process.env.AEGIS_NPM_ARCH || process.arch;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @iliasalmerekov/aegis@0.6.2 matchedPath = scripts/install.js matchedIdentity = npm:QGlsaWFzYWxtZXJla292L2FlZ2lz:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.