Loading npm security reports…

@lingjingai/scriptctl@0.62.3: AI-agent control-surface risk | LPM Firewall

registry / @lingjingai/scriptctl / 0.62.3

@lingjingai/scriptctl@0.62.3

剧本阶段统一 CLI：素材转 Script v4，并兼容 Script v3 的本地写作、精修、校验和发布。

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation automatically modifies three user-home AI-agent skill surfaces. It removes and replaces the scriptctl skill directory in each surface.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install or any dependency installation that runs postinstall

Impact

Unconsented installation can alter instructions and capabilities available to Claude Code, generic agents, and Codex.

Mechanism

automatic replacement of AI-agent skill directories

Policy narrative

The postinstall hook runs automatically during package installation. It resolves the user's home directory, removes any existing scriptctl skill directory under three separate AI-agent roots, copies its bundled skill there, and writes a version marker. This is unconsented mutation of broad external AI-agent control surfaces.

AI rationale

The package has a concrete automatic postinstall chain that replaces skill content in Claude Code, generic agent, and Codex directories. This meets the install-time AI-agent control-surface mutation block policy.

Evidence

package.jsonscripts/install-skill.mjs.claude/skills/scriptctl.agents/skills/scriptctl.codex/skills/scriptctlskills/scriptctl/SKILL.md

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/llm/gemini-video-model.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/infra/llm/gemini-video-model.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/infra/llm/gemini-video-model.jsView on unpkg

314// actually exercised (keeps text-only runs free of @google/genai). L315: const require = createRequire(import.meta.url); L316: function createGoogleClient(apiKey, timeoutMs, baseUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/llm/gemini-video-model.jsView on unpkg · L314

scripts/install-skill.mjsView file

22const TARGET_SKILL_ROOTS = [ L23: path.join(".claude", "skills"), L24: path.join(".agents", "skills"), L25: path.join(".codex", "skills"), L26: ]; ... L58: const stamped = text.replace(/^(\s+)scriptctl_version:.*$/m, `$1scriptctl_version: "${version}"`); L59: fs.writeFileSync(skillMdPath, stamped, "utf-8"); L60: } catch { ... L67: fs.rmSync(target, { recursive: true, force: true }); L68: fs.mkdirSync(path.dirname(target), { recursive: true }); L69: fs.cpSync(skillSrc, target, { recursive: true }); L70: stampVersion(path.join(target, "SKILL.md"), version);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L22

dist/bin.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/bin.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/scriptctl@0.58.0 matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.58.0 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg

dist/usecases/ingest/view-server.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/usecases/ingest/view-server.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usecases/ingest/view-server.jsView on unpkg

dist/review-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/review-agent.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/review-agent.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-skill.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/infra/llm/gemini-video-model.jsView file

Lines 294-334javascript

294 }

295 }

296 return { text, finishReason, usage, raw: response };

297 });

298 return { text: value.text, finishReason: value.finishReason, attempts, usage: addTokenUsage(failedUsage, value.usage), raw: value.raw };

299 }

300 async release(media, signal) {

301 if (media.kind === "base64" || media.kind === "local-fallback" || media.kind === "local")

302 return;

303 try {

304 await this.client.files.delete({ name: media.file.name });

305 }

306 catch (error) {

307 // Cleanup is best-effort (§10.5); a failed delete must not fail the run.

308 void error;

309 void signal;

310 }

311 }

312}

313// Lazily import the SDK so the dependency is only loaded when a video route is

314// actually exercised (keeps text-only runs free of @google/genai).

315const require = createRequire(import.meta.url);

316function createGoogleClient(apiKey, timeoutMs, baseUrl) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infra/llm/gemini-video-model.jsView on unpkg · L314

317 const { GoogleGenAI } = require("@google/genai");

318 const sdk = new GoogleGenAI({

319 apiKey,

320 ...(baseUrl ? { httpOptions: { baseUrl, timeout: timeoutMs } } : {}),

321 });

322 const proxyUrl = (process.env.https_proxy ?? process.env.HTTPS_PROXY ?? process.env.http_proxy ?? process.env.HTTP_PROXY ?? "").trim();

323 // A proxy is set but Node's built-in fetch (which the SDK's get/delete/generate

324 // use) ignores https_proxy unless NODE_USE_ENV_PROXY=1 — so upload (our proxied

325 // https) succeeds and the very next poll fails with "file poll failed". Warn

326 // once with the exact fix rather than let it look like a network error.

327 if (proxyUrl && !(process.env.NODE_USE_ENV_PROXY ?? "").trim()) {

328 process.stderr.write(`⚠️ 检测到代理 ${proxyUrl}，但未设 NODE_USE_ENV_PROXY=1。\n` +

329 ` Gemini 上传会成功、随后的文件轮询/生成会挂（Node 内置 fetch 默认不走代理）。\n` +

330 ` 请在命令前加 NODE_USE_ENV_PROXY=1 重跑。\n`);

331 }

332 // upload goes through Node https (undici rejects the resumable response's

333 // content-length behind a proxy); get/delete/generateContent use the SDK.

334 return {

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/infra/llm/gemini-video-model.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/infra/llm/gemini-video-model.jsView on unpkg

scripts/install-skill.mjsView file

22const TARGET_SKILL_ROOTS = [ L23: path.join(".claude", "skills"), L24: path.join(".agents", "skills"), L25: path.join(".codex", "skills"), L26: ]; ... L58: const stamped = text.replace(/^(\s+)scriptctl_version:.*$/m, `$1scriptctl_version: "${version}"`); L59: fs.writeFileSync(skillMdPath, stamped, "utf-8"); L60: } catch { ... L67: fs.rmSync(target, { recursive: true, force: true }); L68: fs.mkdirSync(path.dirname(target), { recursive: true }); L69: fs.cpSync(skillSrc, target, { recursive: true }); L70: stampVersion(path.join(target, "SKILL.md"), version);

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/install-skill.mjsView on unpkg · L22

dist/bin.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/bin.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @lingjingai/scriptctl@0.58.0 matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.58.0 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin.jsView on unpkg

dist/usecases/ingest/view-server.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/usecases/ingest/view-server.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/usecases/ingest/view-server.jsView on unpkg

dist/review-agent.jsView file

•matchType = normalized_sha256 matchedPackage = @lingjingai/scriptctl@0.62.2 matchedPath = dist/review-agent.js matchedIdentity = npm:QGxpbmdqaW5nYWkvc2NyaXB0Y3Rs:0.62.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/review-agent.jsView on unpkg