Loading npm security reports…

@illuminis/comprism@0.1.5: AI-agent control-surface risk | LPM Firewall

registry / @illuminis/comprism / 0.1.5

@illuminis/comprism@0.1.5

CompletionPrism Companion. Records what finishing a piece of work actually costs - every attempt, and the human time spent noticing and repairing the ones that failed.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically modifies shell startup configuration. The installed script redirects Anthropic-compatible clients to a configured tenant and supplies a workspace header.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Global npm installation invokes the post-install hook.

Impact

Future shell sessions can route a broad AI-client control surface through the package's configured service without an explicit setup command.

Mechanism

The hook calls setup, which writes a script and appends or replaces a marked shell-profile block that exports Anthropic connection settings.

Policy narrative

Installing this package globally automatically activates a lifecycle hook. That hook edits shell profiles so later sessions source a generated script. When a workspace key is present, the script changes Anthropic client routing and sends a workspace identifier to the configured tenant. This is an unconsented post-install mutation of a broad AI-agent control surface.

AI rationale

The automatic global lifecycle chain changes shell startup behavior and AI-client routing. This meets the blocking policy for unconsented post-install mutation of a broad AI-agent control surface.

Evidence

package.jsonout/postinstall.jsout/commands/install.js

Decision evidence

public snapshot

AI identified this as a at 95.0% confidence with false-positive risk.

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node out/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node out/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

out/thin.jsView file

59const self_1 = require("./lib/self"); L60: const out = (s = '') => process.stdout.write(s + '\n'); L61: /** A refusal a script reads: always on standard error (Appendix B). */ ... L163: function throughProxy() { L164: const proxy = process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy; L165: if (!proxy || process.env.NODE_USE_ENV_PROXY) L166: return false; L167: const { spawnSync } = require('child_process'); L168: // Node 22 calls its proxy support experimental and says so on every start; L169: // that one notice is not the person's concern. L170: const [cmd, argv] = (0, self_1.selfLaunch)(process.argv.slice(2), ['--disable-warning=UNDICI-EHPA']); L171: const r = spawnSync(cmd, argv, {

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

out/thin.jsView on unpkg · L59

166return false; L167: const { spawnSync } = require('child_process'); L168: // Node 22 calls its proxy support experimental and says so on every start;

High

Child Process

Package source references child process execution.

out/thin.jsView on unpkg · L166

180if (process.argv[2] === '__relay' && (0, self_1.isStandalone)() && process.env.COMPRISM_RELAY) { L181: new Function('require', 'process', process.env.COMPRISM_RELAY)(require, process); L182: return;

High

Eval

Package source references dynamic code evaluation.

out/thin.jsView on unpkg · L180

out/lib/clipboard.js#virtual:normalized:round1View file

41* A terminal cannot hand a program a picture: Ctrl+V and Cmd+V paste text. L42: * So `paste` asks the operating system for the clipboard"s picture with the\n * tool each one already has, writes it to a file in a fresh temporary folder,\n * and the session atta... L43: // an argument to the script, never part of its text.

High

Shell

Package source references shell execution.

out/lib/clipboard.js#virtual:normalized:round1View on unpkg · L41

out/graph/files.jsView file

66* everywhere would quietly remove real code from somebody's map. Next to a L67: * package.json it is almost always generated. L68: *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

out/graph/files.jsView on unpkg · L66

out/commands/install.js#virtual:normalized:round1View file

38* L39: * The tenant"s own hosted endpoint: `https://{tenant}.completionprism.illuminis.ai`.\n * Claude Code and every Anthropic SDK append `/v1/messages` to it themselves.\n *\n * It used... L40: * in this order, and the order is the whole safety argument: ... L46: * break every AI tool on the machine, and "our measurement tool broke Claude\n * Code" is the single worst outcome this product can produce - worse by far than L47: * missing a day of data. So the failure mode is silence: the user"s tools talk\n * straight to the provider exactly as they did before, and we record nothing.\n * That is rule 10 a... L48: * where it exists, PowerShell 7"s. Windows PowerShell"s is created when there ... L51: function powershellProfiles() { L52: if (process.platform !== "win32" && !process.env.CO

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

out/commands/install.js#virtual:normalized:round1View on unpkg · L38

out/executor/sandbox.js#virtual:normalized:round1View file

93function quote(p) { L94: return `"${p.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;\n}\n/** Does this host match an allowed address: exact, or `*.example.com`. */\nfunction hostAllowed(host, allow) {\n ... L95: return `blocked by the sandbox: network access to ${host} is not allowed`;

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

out/executor/sandbox.js#virtual:normalized:round1View on unpkg · L93

93Trigger-reachable command-output exfiltration chain: manifest.main -> out/thin.js -> out/agent/command.js -> out/executor/sandbox.js L93: function quote(p) { L94: return `"${p.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;\n}\n/** Does this host match an allowed address: exact, or `*.example.com`. */\nfunction hostAllowed(host, allow) {\n ... L95: return `blocked by the sandbox: network access to ${host} is not allowed`;

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

out/executor/sandbox.js#virtual:normalized:round1View on unpkg · L93

out/commands/install.jsView file

342// beside the right ones, and the person cannot tell which is which. L343: const servers = config.mcpServers; L344: if (!servers || !servers.completionprism) { ... L348: if (Object.keys(servers).length === 0) L349: delete config.mcpServers; L350: else L351: config.mcpServers = servers; L352: node_fs_1.default.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`); L353: return { configPath, present: true, registered: false, staleRemoved: true }; ... L439: } L440: const servers = config.mcpServers; L441: if (!servers || !servers.completionprism)

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

out/commands/install.jsView on unpkg · L342

•Trigger-reachable chain: scripts.postinstall -> out/postinstall.js -> out/commands/install.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

out/commands/install.jsView on unpkg

out/native/dictateView file

•path = out/native/dictate kind = native_binary sizeBytes = 85112 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

out/native/dictateView on unpkg

scripts/read_python.pyView file

•path = scripts/read_python.py kind = build_helper sizeBytes = 10841 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/read_python.pyView on unpkg

out/agent/command.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

out/agent/command.js#virtual:normalized:round1View on unpkg