@jaybeeuu/agent-cortex@1.39.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@jaybeeuu/agent-cortex@1.39.0: Malicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = bash scripts/install-instructions.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

29"scripts": { "build": "echo 'Build complete — no compilation needed for PI package'", "lint": "pnpm typecheck", "test": "node --test test/*.test.mjs && pnpm -r test", "typecheck": "pnpm -r typecheck", "build:claude": "node bin/agent-cortex.mjs install claude --output claude", "build:copilot": "node scripts/build-copilot-agents.mjs", "changeset": "changeset", "version-packages": "changeset version && bash scripts/sync-plugin-version.sh && pnpm build:claude && pnpm build:copilot", "publish-package": "TARBALL=$(pnpm pack | tail -n 1) && npm publish \"$TARBALL

High

Suspicious Lifecycle Evidence

The npm postinstall hook automatically runs a shell script.

package.jsonView on unpkg · L29

•scripts.postinstall = bash scripts/install-instructions.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/scripts/statusline-command.shView file

•path = claude/scripts/statusline-command.sh kind = build_helper sizeBytes = 4101 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

claude/scripts/statusline-command.shView on unpkg

bin/installers/claude.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/installers/claude.mjs#virtual:normalized:round1View on unpkg

scripts/install-instructions.shView file

8INSTRUCTIONS_FILE="$HOME/.copilot/copilot-instructions.md" MARKER_START="" MARKER_END="" BLOCK="$MARKER_START  ## Proactive skill use (agent-cortex plugin) You have a set of custom skills available. Apply them automatically whenever they are relevant — the user should not have to invoke them by name.

High

Ai Review Evidence

That script targets the user-global Copilot instruction file and injects agent directives.

scripts/install-instructions.shView on unpkg · L8

58mkdir -p "$(dirname "$INSTRUCTIONS_FILE")" if [ ! -f "$INSTRUCTIONS_FILE" ]; then printf '%s\n' "$BLOCK" > "$INSTRUCTIONS_FILE" echo "✓ Created $INSTRUCTIONS_FILE" elif grep -qF "$MARKER_START" "$INSTRUCTIONS_FILE"; then # Write replacement block to a temp file so awk can read it with getline BLOCK_FILE=$(mktemp) printf '%s\n' "$BLOCK" > "$BLOCK_FILE" awk -v start="$MARKER_START" -v end="$MARKER_END" -v blockfile="$BLOCK_FILE" ' $0 == start { while ((getline line < blockfile) > 0) print line close(blockfile) skip=1; next } $0 == end { skip=0; next }

High

Ai Review Evidence

The script creates, replaces, or appends the managed block without an explicit setup command.

scripts/install-instructions.shView on unpkg · L58

Lines 38-78text

38- Use **grill-me** or **grill-with-docs** when the user wants to stress-test a plan or design.

39- Use **improve-codebase-architecture** when the user wants to find architectural improvement opportunities.

40

41### Task execution

42

43- Use **bd-tool** whenever the user mentions beads, bd, tasks, or asks what work is available.

44- Use **ralph** to run all pending beads end-to-end with review gates.

45- Use **run-pipeline-stage** to work through individual pipeline stages inline.

46- Use **hitl-collab** when a task requires human review, manual steps, or a PR handoff.

47- Use **classify-bead** when a bead is missing its implementation-type label.

48

49### Repo & plugin maintenance

50

51- Use **maintain-agent-docs** when reviewing or updating AGENTS.md or agent-consumed docs.

52- Use **refactor-skill** when restructuring or reviewing an existing skill.

53- Use **write-a-skill** when creating a new skill.

54- Use **init-beads** when setting up the bd task-tracker in a new project.

55

56$MARKER_END"

57

58mkdir -p "$(dirname "$INSTRUCTIONS_FILE")"

59

60if [ ! -f "$INSTRUCTIONS_FILE" ]; then

61 printf '%s\n' "$BLOCK" > "$INSTRUCTIONS_FILE"

62 echo "✓ Created $INSTRUCTIONS_FILE"

63elif grep -qF "$MARKER_START" "$INSTRUCTIONS_FILE"; then

64 # Write replacement block to a temp file so awk can read it with getline

65 BLOCK_FILE=$(mktemp)

66 printf '%s\n' "$BLOCK" > "$BLOCK_FILE"

67 awk -v start="$MARKER_START" -v end="$MARKER_END" -v blockfile="$BLOCK_FILE" '

68 $0 == start {

69 while ((getline line < blockfile) > 0) print line

High

Ai Review Evidence

The script creates, replaces, or appends the managed block without an explicit setup command.

scripts/install-instructions.shView on unpkg · L58

70 close(blockfile)

71 skip=1; next

72 }

73 $0 == end { skip=0; next }

74 !skip { print }

75 ' "$INSTRUCTIONS_FILE" > "${INSTRUCTIONS_FILE}.tmp"

76 mv "${INSTRUCTIONS_FILE}.tmp" "$INSTRUCTIONS_FILE"

77 rm -f "$BLOCK_FILE"

78 echo "✓ Updated agent-cortex section in $INSTRUCTIONS_FILE"