Loading npm security reports…

@iliasalmerekov/aegis@0.6.6: AI-agent control-surface risk | LPM Firewall

registry / @iliasalmerekov/aegis / 0.6.6

@iliasalmerekov/aegis@0.6.6

Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations

AI Security Review

scanned 22d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads a native binary from GitHub releases and, when ~/.claude or ~/.codex already exists, runs that binary with install-hooks --all. That changes other vendors' agent configs during install without an explicit user setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install running the postinstall script

Impact

Claude Code and Codex control surfaces can be rewritten at install time by an opaque downloaded binary.

Mechanism

postinstall native download then unconsented foreign agent hook install

Policy narrative

When a user runs npm install, postinstall downloads a native binary from this project's GitHub releases, verifies SHA256, then if the home directory already has a Claude Code or Codex config folder, it executes that binary with install-hooks --all. Those folders belong to other vendors' agents, not this package. There is no interactive prompt and the only skip is an environment variable. The hook command runs inside an opaque binary, so this review cannot see which agent files are rewritten. That is unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

postinstall in package.json runs scripts/install.js, which fetches a native binary and then, when ~/.claude or ~/.codex already exists, executes install-hooks --all with no opt-in prompt. That is unconsented install-time mutation of foreign AI-agent control surfaces, which is a publish block.

Evidence

package.jsonscripts/install.jschecksums.jsonvendor/aegis~/.claude

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L11: const vendorDir = path.join(packageRoot, "vendor"); L12: const binaryPath = path.join(vendorDir, "aegis"); L13: const checksumsPath = path.join(packageRoot, "checksums.json"); ... L29: L30: // Binary-only install: never edit shell startup files here. Point users at the L31: // explicit opt-in `aegis setup-shell` command so enabling the shell proxy is a

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/aegis.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/aegis.jsView on unpkg · L3

scripts/install.jsView file

60L61: const claudeDir = path.join(home, ".claude"); L62: const codexDir = path.join(home, ".codex"); L63: const hasAgentDir = fs.existsSync(claudeDir) || fs.existsSync(codexDir); ... L169: L170: fs.mkdirSync(vendorDir, { recursive: true }); L171: L172: if (process.env.AEGIS_NPM_SKIP_DOWNLOAD === "1") { L173: fs.writeFileSync(binaryPath, "#!/bin/sh\nprintf 'aegis test binary\\n'\n", { mode: 0o755 }); L174: printNextSteps();

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L60

4const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L14: L15: const platform = process.env.AEGIS_NPM_PLATFORM || process.platform; L16: const arch = process.env.AEGIS_NPM_ARCH || process.arch;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @iliasalmerekov/aegis@0.6.5 matchedPath = scripts/install.js matchedIdentity = npm:QGlsaWFzYWxtZXJla292L2FlZ2lz:0.6.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.