Loading npm security reports…

@jolli.ai/cli@0.99.17: AI-agent control-surface risk | LPM Firewall

registry / @jolli.ai/cli / 0.99.17

@jolli.ai/cli@0.99.17

Automatic development memory for AI coding agents: turns your Claude Code, Codex, Gemini, Cursor, Copilot, Cline, Devin, OpenCode, Antigravity and Kimi Code sessions into structured commit summaries your agent can recall over MCP

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. An npm postinstall can invoke an installer without a user command. That installer modifies global AI-agent instruction and MCP control surfaces.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Installing the package when the existing Jolli state directory is present and the package path is outside the current project's node_modules.

Impact

AI coding agents can be configured to launch Jolli components and receive injected instructions without consent at this installation event.

Mechanism

Automatic global AI-agent configuration and MCP registration.

Policy narrative

The package's postinstall launches PostInstall.js. If a Jolli state marker exists, that script invokes the installer outside a local node_modules installation. The installer writes global agent instruction files and registers a Jolli MCP command in global Codex configuration, with registration support for numerous other agent hosts. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The guarded condition does not supply consent for a new npm lifecycle event. The postinstall-to-installer chain directly mutates global agent control files, meeting the install-control-surface block policy.

Evidence

package.jsondist/PostInstall.jsdist/Installer.js~/.claude/CLAUDE.md~/.gemini/GEMINI.md~/.codex/AGENTS.md~/.codex/config.toml~/.gemini/settings.json

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/McpServer.jsView file

467try { L468: m = await import(vn(c).href); L469: } catch (h) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/McpServer.jsView on unpkg · L467

46try { L47: const n = await B(e ?? Xe(), "utf-8"), t = JSON.parse(n); L48: if (!W(t) || typeof t.checkedAt != "string" || typeof t.ttlHours != "number" || !(t.ttlHours > 0) || !W(t.packages)) return null; ... L279: }; L280: if (process.env.JOLLI_NO_PLUGINS === "1") return { L281: known: n, ... L352: if (e?.rootsOverride) return e.rootsOverride; L353: const n = [], t = process.cwd(), o = Qe(t).root, r = e?.homedirOverride ?? Sn(), s = ((p) => { L354: let m = p; ... L414: if (!c.isDirectory() && !c.isSymbolicLink()) continue; L415: const p = C(l, c.name), m = C(p, "package.json"); L416: if (!R(m)) continue;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/McpServer.jsView on unpkg · L46

dist/GitOps.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/GitOps.js#virtual:string-array:round1View on unpkg

dist/dashboard-assets/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.2 matchedPath = dist/web/public/vendor/marked.min.js matchedIdentity = npm:YWljb2RlbWFu:1.24.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard-assets/vendor/marked.min.jsView on unpkg

dist/graph-assets/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.2 matchedPath = dist/web/public/vendor/marked.min.js matchedIdentity = npm:YWljb2RlbWFu:1.24.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/graph-assets/vendor/marked.min.jsView on unpkg

dist/Summarizer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jolli.ai/cli@0.99.14 matchedIdentity = npm:QGpvbGxpLmFpL2NsaQ:0.99.14 similarity = 0.658 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/Summarizer.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 26-66json

26 "schemas/",

27 "README.md"

28 ],

29 "scripts": {

30 "all": "npm run clean && npm run build && npm run lint && npm run test",

31 "build": "vite build && tsc --project tsconfig.build.json",

32 "postbuild": "node -e \"require('fs').chmodSync('dist/Cli.js', 0o755)\"",

33 "clean": "rimraf dist/",

34 "typecheck": "tsc --noEmit",

35 "lint": "biome check --error-on-warnings",

36 "lint:fix": "biome check --write",

37 "cli": "tsx src/Cli.ts",

38 "cli:build": "npm run build && node dist/Cli.js",

39 "gen:telemetry-doc": "tsx scripts/gen-telemetry-doc.mjs",

40 "test": "vitest run --coverage",

41 "test:fast": "vitest run --mode fast --coverage --reporter=dot",

42 "test:slow": "vitest run --mode slow --reporter=dot",

43 "test:changed": "vitest run --changed origin/main --reporter=dot",

44 "test:watch": "vitest",

45 "test:acceptance": "vitest run --config vitest.acceptance.config.ts",

46 "postinstall": "node -e \"require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 },

48 "keywords": [

49 "ai",

50 "ai-agent",

51 "coding-agent",

52 "mcp",

53 "model-context-protocol",

54 "memory",

55 "documentation",

56 "git-hooks",

57 "claude-code",

58 "codex",

59 "gemini",

60 "opencode",

61 "kimi",

62 "cursor",

63 "copilot",

64 "cline",

65 "devin",

66 "antigravity",

dist/McpServer.jsView file

Lines 26-66javascript

26import { homedir as Sn } from "node:os";

27import { existsSync as R } from "node:fs";

28import { fileURLToPath as kn, pathToFileURL as vn } from "node:url";

dist/GitOps.js#virtual:string-array:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/GitOps.js#virtual:string-array:round1View on unpkg

dist/dashboard-assets/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.2 matchedPath = dist/web/public/vendor/marked.min.js matchedIdentity = npm:YWljb2RlbWFu:1.24.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/dashboard-assets/vendor/marked.min.jsView on unpkg

dist/graph-assets/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = aicodeman@1.24.2 matchedPath = dist/web/public/vendor/marked.min.js matchedIdentity = npm:YWljb2RlbWFu:1.24.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/graph-assets/vendor/marked.min.jsView on unpkg

dist/Summarizer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @jolli.ai/cli@0.99.14 matchedIdentity = npm:QGpvbGxpLmFpL2NsaQ:0.99.14 similarity = 0.658 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/Summarizer.jsView on unpkg