Loading npm security reports…

@iliasalmerekov/aegis@0.6.7: AI-agent control-surface risk | LPM Firewall

registry / @iliasalmerekov/aegis / 0.6.7

@iliasalmerekov/aegis@0.6.7

Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall downloads a native Aegis binary from GitHub, then automatically runs install-hooks --all whenever ~/.claude or ~/.codex already exists. That mutates foreign Claude Code and Codex agent config without a separate setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package with npm, which runs the postinstall script.

Impact

Claude Code or Codex can load package-installed hooks that intercept later agent tool use.

Mechanism

Unconsented install-time agent hook installation

Policy narrative

When this package is installed, postinstall downloads a native binary from GitHub and then, if ~/.claude or ~/.codex already exists, runs that binary as install-hooks --all. Those folders belong to Claude Code and Codex, so the install writes into a foreign agent control surface without a separate setup command. Skipping that step requires AEGIS_NPM_SKIP_HOOKS=1; otherwise hook installation is the default. The JavaScript wrapper does not edit shell startup files, but the installed hooks can intercept later agent tool use.

AI rationale

Postinstall fetches a native binary and, when Claude Code or Codex config directories already exist, runs install-hooks --all without an explicit user command. That is unconsented install-time mutation of a foreign AI-agent control surface, so this release should be blocked.

Evidence

package.jsonscripts/install.jsvendor/aegischecksums.json~/.claude~/.codex

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node scripts/install.js Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L11: const vendorDir = path.join(packageRoot, "vendor"); L12: const binaryPath = path.join(vendorDir, "aegis"); L13: const checksumsPath = path.join(packageRoot, "checksums.json"); ... L29: L30: // Binary-only install: never edit shell startup files here. Point users at the L31: // explicit opt-in `aegis setup-shell` command so enabling the shell proxy is a

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/aegis.jsView file

3L4: const { spawnSync } = require("node:child_process"); L5: const path = require("node:path");

High

Child Process

Package source references child process execution.

bin/aegis.jsView on unpkg · L3

scripts/install.jsView file

60L61: const claudeDir = path.join(home, ".claude"); L62: const codexDir = path.join(home, ".codex"); L63: const hasAgentDir = fs.existsSync(claudeDir) || fs.existsSync(codexDir); ... L169: L170: fs.mkdirSync(vendorDir, { recursive: true }); L171: L172: if (process.env.AEGIS_NPM_SKIP_DOWNLOAD === "1") { L173: fs.writeFileSync(binaryPath, "#!/bin/sh\nprintf 'aegis test binary\\n'\n", { mode: 0o755 }); L174: printNextSteps();

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install.jsView on unpkg · L60

4const fs = require("node:fs"); L5: const https = require("node:https"); L6: const os = require("node:os"); L7: const path = require("node:path"); L8: const { spawnSync } = require("node:child_process"); L9: ... L14: L15: const platform = process.env.AEGIS_NPM_PLATFORM || process.platform; L16: const arch = process.env.AEGIS_NPM_ARCH || process.arch;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = @iliasalmerekov/aegis@0.6.6 matchedPath = scripts/install.js matchedIdentity = npm:QGlsaWFzYWxtZXJla292L2FlZ2lz:0.6.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.