Loading npm security reports…

@lingjingai/scriptctl@0.62.1: AI-agent control-surface risk | LPM Firewall

registry / @lingjingai/scriptctl / 0.62.1

@lingjingai/scriptctl@0.62.1

剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes three AI-agent skill control surfaces in the user home directory. It replaces the scriptctl skill content without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation, through the postinstall lifecycle hook.

Impact

The package can inject or replace instructions available to Claude, Agents, and Codex after installation.

Mechanism

Automatic deletion and replacement of AI-agent skill directories.

Policy narrative

An npm postinstall hook invokes the bundled installer automatically. The installer resolves the user home directory, deletes existing scriptctl directories under Claude, Agents, and Codex skill roots, copies package-supplied skill content there, and writes a version marker. This is an unconsented install-time mutation of multiple foreign AI-agent control surfaces.

AI rationale

The automatic postinstall hook modifies three user-level AI-agent skill locations and forcibly replaces their contents. The opt-out flag does not establish consent for the default install-time behavior.

Evidence

package.jsonscripts/install-skill.mjsskills/scriptctl~/.claude/skills/scriptctl~/.agents/skills/scriptctl~/.codex/skills/scriptctl

Decision evidence

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/llm/gemini-video-model.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.7 matchedPath = dist/infra/llm/gemini-video-model.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/infra/llm/gemini-video-model.jsView on unpkg

314// actually exercised (keeps text-only runs free of @google/genai). L315: const require = createRequire(import.meta.url); L316: function createGoogleClient(apiKey, timeoutMs, baseUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/llm/gemini-video-model.jsView on unpkg · L314

scripts/install-skill.mjsView file

22const TARGET_SKILL_ROOTS = [ L23: path.join(".claude", "skills"), L24: path.join(".agents", "skills"), L25: path.join(".codex", "skills"), L26: ]; ... L58: const stamped = text.replace(/^(\s+)scriptctl_version:.*$/m, `$1scriptctl_version: "${version}"`); L59: fs.writeFileSync(skillMdPath, stamped, "utf-8"); L60: } catch { ... L67: fs.rmSync(target, { recursive: true, force: true }); L68: fs.mkdirSync(path.dirname(target), { recursive: true }); L69: fs.cpSync(skillSrc, target, { recursive: true }); L70: stampVersion(path.join(target, "SKILL.md"), version);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L22

dist/bin.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.3 matchedPath = dist/bin.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin.jsView on unpkg

dist/usecases/ingest/view-server.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.7 matchedPath = dist/usecases/ingest/view-server.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usecases/ingest/view-server.jsView on unpkg

dist/review-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.7 matchedPath = dist/review-agent.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/review-agent.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 4-44json

4 "description": "剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。",

5 "type": "module",

6 "bin": {

7 "scriptctl": "./dist/bin.js"

8 },

9 "main": "./dist/cli.js",

10 "types": "./dist/cli.d.ts",

11 "files": [

12 "dist",

13 "changes",

14 "skills",

15 "scripts/install-skill.mjs",

16 "README.md"

17 ],

18 "engines": {

19 "node": ">=20"

20 },

21 "scripts": {

22 "build": "pnpm --filter @lingjingai/screenplay build && pnpm --filter @lingjingai/review-agent build && tsc && node scripts/bundle.mjs",

23 "clean": "rm -rf dist packages/screenplay/dist",

24 "postinstall": "node scripts/install-skill.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 "install-skill": "node scripts/install-skill.mjs",

26 "prepublishOnly": "pnpm run clean && pnpm run build",

27 "pretest": "pnpm run build",

28 "test": "vitest run",

29 "pretest:coverage": "pnpm run build",

30 "test:coverage": "c8 --reporter=text --reporter=html --reporter=lcov --report-dir=coverage vitest run",

31 "test:watch": "vitest",

32 "typecheck": "tsc --noEmit",

33 "surface:snapshot": "node scripts/scriptctl-surface-snapshot.mjs"

34 },

35 "dependencies": {

36 "@anthropic-ai/sdk": "^0.111.0",

37 "@google/genai": "^2.11.0",

38 "commander": "^12.1.0",

39 "fast-json-patch": "^3.1.1",

40 "fast-xml-parser": "^5.9.0",

41 "https-proxy-agent": "^9.1.0",

42 "jszip": "^3.10.1",

43 "nanoid": "^5.1.16",

44 "proper-lockfile": "^4.1.2",

dist/infra/llm/gemini-video-model.jsView file

Lines 294-334javascript

294 }

295 }

296 return { text, finishReason, usage, raw: response };

297 });

298 return { text: value.text, finishReason: value.finishReason, attempts, usage: addTokenUsage(failedUsage, value.usage), raw: value.raw };

299 }

300 async release(media, signal) {

scripts/install-skill.mjsView file

Lines 2-42javascript

2// postinstall: 把打包进 npm 包的 scriptctl skill 装到用户根目录下的三处 skill 目录

3// （Claude Code / agents / codex），并把「本次安装对应的 scriptctl 版本号」戳进每份

4// SKILL.md 的 frontmatter + 一个 .scriptctl-version 标记文件里。

5//

6// 设计要点：

7// - 永不让安装失败：全程 try/catch，任何异常只打印警告并以 0 退出（skill 装不上不该

8// 拖垮 `npm i -g scriptctl` 本身）。

9// - 开发态跳过：源码检出（存在 src/）不是「已发布的包」，跳过，免得 dev `pnpm install`

10// 覆盖你本地手改的 skill。

11// - 可关闭：SCRIPTCTL_SKIP_SKILL_INSTALL=1 或 SCRIPTCTL_SKILL_INSTALL=0。

dist/bin.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.3 matchedPath = dist/bin.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin.jsView on unpkg

dist/usecases/ingest/view-server.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.7 matchedPath = dist/usecases/ingest/view-server.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usecases/ingest/view-server.jsView on unpkg

dist/review-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.7 matchedPath = dist/review-agent.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/review-agent.jsView on unpkg