registry / @impakers/debug / 1.9.9

@impakers/debug@1.9.9

Client feedback collection tool for Impakers OS

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package runs a postinstall script that plants a first-party Claude skill in the consumer project. The skill tells the agent how to map UI files for this feedback widget and can also insert an ESLint preset. No credential theft, remote payload, or destructive action was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall, or running the impakers-debug-setup command, when skip checks pass.

Impact

A future Claude session in that project can load package-authored instructions on ordinary UI edits without a separate consent prompt at install time. Existing unmanaged skill files are preserved.

Mechanism

The script resolves the consumer project root and writes templates/ui-mapping-skill.md to .claude/skills/impakers-ui-mapping/SKILL.md, creating directories as needed, then may append this package ESLint preset to an existing flat config.

AI rationale

Postinstall writes a package-owned Claude skill into the consumer project without a consent prompt, which is guarded first-party agent extension setup rather than a hijack. The skill content matches the stated UI-mapping product and does not exfiltrate data or run a remote payload.

Evidence

package.jsonscripts/setup.mjstemplates/ui-mapping-skill.md.claude/skills/impakers-ui-mapping/SKILL.mdeslint.config.jseslint.config.mjseslint.config.cjs

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

npm postinstall runs node ./scripts/setup.mjs with no user prompt.
On a normal install the script writes the package skill template into the consumer project at .claude/skills/impakers-ui-mapping/SKILL.md.
When skip checks pass, main always installs that skill and may also patch the project ESLint flat config.
The installed file is a Claude skill whose description auto-triggers on common UI file edits.

Evidence against

An environment flag skips setup, and files that lack the package managed marker are left untouched.
The skill text is product UI-mapping guidance and contains no network call, credential read, or shell payload.
Writes stay in the consumer project skill path and optional ESLint config, not the user home directory or global agent settings.
ESLint edits are syntax-checked and rolled back if parsing fails.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 631 KB of source, external domains: drive.google.com, github.com, os.impakers.club, view.officeapps.live.com, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 99-139json

99 "require": {

100 "types": "./dist/telemetry-next.d.ts",

101 "default": "./dist/telemetry-next.js"

102 }

103 }

104 },

105 "bin": {

106 "impakers-debug-setup": "./scripts/setup.mjs"

107 },

108 "files": [

109 "dist",

110 "scripts/setup.mjs",

111 "templates",

112 "CHANGELOG.md"

113 ],

114 "scripts": {

115 "build": "tsup",

116 "watch": "tsup --watch",

117 "dev": "pnpm build && pnpm watch",

118 "prepublishOnly": "pnpm build",

119 "postinstall": "node ./scripts/setup.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L119

120 "test": "vitest run",

121 "test:watch": "vitest"

122 },

123 "peerDependencies": {

124 "eslint": ">=8.57.0",

125 "next": ">=13.4.0",

126 "react": ">=18.0.0",

127 "react-dom": ">=18.0.0"

128 },

129 "peerDependenciesMeta": {

130 "eslint": {

131 "optional": true

132 },

133 "next": {

134 "optional": true

135 },

136 "react": {

137 "optional": true

138 },

139 "react-dom": {

scripts/setup.mjsView file

Lines 1-44javascript

1#!/usr/bin/env node

2// =============================================================================

3// @impakers/debug — 설치 시 자동 셋업

4// =============================================================================

5//

6// `npm i @impakers/debug` 하면 postinstall로 이 스크립트가 돌면서 두 가지를 한다.

7//

8// 1. .claude/skills/impakers-ui-mapping/SKILL.md 설치

9// 에이전트가 UI 코드를 짤 때 파일 매핑 규칙을 알고 있게 만든다.

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/setup.mjsView file

7// L8: // 1. .claude/skills/impakers-ui-mapping/SKILL.md 설치 L9: // 에이전트가 UI 코드를 짤 때 파일 매핑 규칙을 알고 있게 만든다. ... L114: /** L115: * .claude/skills/impakers-ui-mapping/SKILL.md 를 깐다. L116: * ... L126: L127: const target = path.join(root, ".claude", "skills", "impakers-ui-mapping", "SKILL.md"); L128: const next = fs.readFileSync(source, "utf-8"); ... L136: if (current === next) return; L137: fs.writeFileSync(target, next); L138: note(`스킬 갱신: ${rel(root, target)}`);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/setup.mjsView on unpkg · L7

24Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L24: L25: import { spawnSync } from "node:child_process"; L26: import * as fs from "node:fs"; ... L39: /** postinstall은 조용해야 한다. 명시 실행(npx)일 때만 수다스러워진다. */ L40: const explicit = process.argv.includes("--explicit") || !process.env.npm[redacted]; L41: const silent = process.env.npm[redacted] === "silent"; ... L58: function resolveConsumerRoot() { L59: const candidate = explicit ? process.cwd() : process.env.INIT_CWD; L60: if (!candidate) return null; ... L88: L89: const manifestPath = path.join(root, "package.json"); L90: if (!fs.existsSync(manifestPath)) return "프로젝트 package.json 없음";

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/setup.mjsView on unpkg · L24

•matchType = normalized_sha256 matchedPackage = @impakers/debug@1.9.7 matchedPath = scripts/setup.mjs matchedIdentity = npm:QGltcGFrZXJzL2RlYnVn:1.9.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/setup.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @impakers/debug@1.9.3 matchedIdentity = npm:QGltcGFrZXJzL2RlYnVn:1.9.3 similarity = 0.471 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/setup.mjsView on unpkg

Findings

1 Critical4 High3 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighEntrypoint Build Divergencescripts/setup.mjs

HighKnown Malware Source Similarityscripts/setup.mjs

HighPrevious Version Dangerous Deltascripts/setup.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @impakers/debug@1.9.9.

See version security history for other recorded verdicts.

Review the evidence and your use of @impakers/debug@1.9.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-28 00:26:37.648Z (UTC).