Loading npm security reports…

@inizioevoke/astro-core@3.3.0: AI-agent control-surface risk | LPM Firewall

registry / @inizioevoke/astro-core / 3.3.0

@inizioevoke/astro-core@3.3.0

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install runs postinstall.mjs, which deletes and recopies bundled Claude skill files into the consumer project's .claude/skills directory. The skill widens when the coding agent should follow this package.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install lifecycle postinstall

Impact

The project Claude skill surface is rewritten during install, so later agent sessions follow this package's instructions without a separate setup command.

Mechanism

The script resolves the consumer project root, removes each destination skill directory, and copies agents/claude into .claude/skills. The installed skill instructs the agent to activate on generic interface requests.

Policy narrative

On npm install, postinstall.mjs walks three directories up from the package and treats that location as the consumer project. It deletes each skill directory under .claude/skills that matches the bundled agents/claude tree, then copies those skills into place. The installed skill tells Claude to use this library for carousels, modals, tabs, PDF viewers, and similar requests even when the user never names the package. Install therefore rewrites the project's agent control surface.

AI rationale

The postinstall hook unconditionally replaces directories in the consumer project's .claude/skills with a package-supplied Claude skill that auto-triggers on generic UI requests. That is an unconsented install-time write to a foreign agent control surface.

Evidence

package.jsonpostinstall.mjsagents/claude/evoke-astro-core/SKILL.md.claude/skills

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/components/PdfViewer/pdf.worker.min.mjsView file

24* pdfjsBuild = 7e5b36c2d L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[1/0,1/0,-1/0,-1/0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/components/PdfViewer/pdf.worker.min.mjsView on unpkg · L24

postinstall.mjsView file

1Install-time AI-agent control hijack evidence: L1: import { cpSync, readdirSync, rmSync } from 'fs'; L2: import { join, dirname } from 'path'; ... L8: const projectRoot = join(__dirname, '..', '..', '..'); L9: const destDir = join(projectRoot, '.claude', 'skills'); L10: const src = join(__dirname, 'agents', 'claude'); ... L15: rmSync(skillDestDir, { recursive: true, force: true }); L16: cpSync(join(src, dir), skillDestDir, { recursive: true }); L17: } Payload evidence from agents/claude/evoke-astro-core/SKILL.md: L232: L233: Custom event: `evopdfviewer-click` (fires when a custom `http://pdfviewer.evo` protocol link is clicked) L234:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L1

src/components/Carousel/Carousel.astroView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/components/Carousel/Carousel.astroView on unpkg

src/components/PdfViewer/pdf.min.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 3e49050356b20456 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @inizioevoke/astro-core@3.2.4 matchedPath = src/components/PdfViewer/pdf.min.mjs matchedIdentity = npm:QGluaXppb2V2b2tlL2FzdHJvLWNvcmU:3.2.4 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/components/PdfViewer/pdf.min.mjsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 "./BottomISI": "./src/components/ISI/BottomISI/index.ts",

14 "./Carousel": "./src/components/Carousel/index.ts",

15 "./CssBackgroundImage": "./src/components/CssBackgroundImage/index.ts",

16 "./CssVariables": "./src/components/CssVariables/index.ts",

17 "./FlipCard": "./src/components/FlipCard/index.ts",

18 "./InlineImage": "./src/components/InlineImage/index.ts",

19 "./Modal": "./src/components/Modal/index.ts",

20 "./ScrollContainer": "./src/components/ScrollContainer/index.ts",

21 "./Tabs": "./src/components/Tabs/index.ts",

22

23 "./lib/BottomISI": "./src/components/ISI/BottomISI/BottomISI.ts",

24 "./lib/Carousel": "./src/components/Carousel/Carousel.ts",

25 "./lib/FlipCard": "./src/components/FlipCard/FlipCard.ts",

26 "./lib/Modal": "./src/components/Modal/Modal.ts",

27 "./lib/ScrollContainer": "./src/components/ScrollContainer/ScrollContainer.ts",

28

29 "./lib/gestures/pinch": "./src/lib/client/gestures/pinch.ts",

30 "./lib/gestures/swipe": "./src/lib/client/gestures/swipe.ts"

31 },

32 "scripts": {

33 "postinstall": "node postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "files": [

36 "agents",

37 "docs",

38 "src",

39 "postinstall.mjs"

40 ],

41 "peerDependencies": {

42 "astro": ">=5.0.0",

43 "typescript": ">=5.0.0"

44 },

45 "devDependencies": {

46 "@astrojs/check": "^0.9.8",

47 "@astrojs/ts-plugin": "^1.10.7",

48 "@types/node": "^25.5.0",

49 "astro": "^6.0.5",

50 "pdfjs-dist": "^5.7.284",

51 "typescript": "^5.9.3"

52 }

53}

src/components/PdfViewer/pdf.worker.min.mjsView file

24* pdfjsBuild = 7e5b36c2d L25: */const e=!("object"!=typeof process||process+""!="[object process]"||process.versions.nw||process.versions.electron&&process.type&&"browser"!==process.type),t=[1/0,1/0,-1/0,-1/0],... L26: /*webpackIgnore: true*/

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/components/PdfViewer/pdf.worker.min.mjsView on unpkg · L24

postinstall.mjsView file

Lines 1-19javascript

1import { cpSync, readdirSync, rmSync } from 'fs';

2import { join, dirname } from 'path';

3import { fileURLToPath } from 'url';

4

5const __dirname =

src/components/Carousel/Carousel.astroView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 18

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

src/components/Carousel/Carousel.astroView on unpkg

src/components/PdfViewer/pdf.min.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 3e49050356b20456 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @inizioevoke/astro-core@3.2.4 matchedPath = src/components/PdfViewer/pdf.min.mjs matchedIdentity = npm:QGluaXppb2V2b2tlL2FzdHJvLWNvcmU:3.2.4 similarity = 1.000 shingleOverlap = 9 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/components/PdfViewer/pdf.min.mjsView on unpkg