registry / AI-agent control-surface risk / @lsproxy/cli
@lsproxy/cli
Standalone refactor CLI driving any LSP server: project-wide rename, file-move with importer updates, and move-symbol
This report shows the evidence for @lsproxy/cli@0.11.4. 2 of 8 known versions are blocked or flagged. The newest version, 1.1.2, is flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiAlthough the CLI runtime behavior is largely aligned with LSP/refactoring functionality, the unguarded install-time write into ~/.claude/skills matches the policy for unconsented lifecycle mutation of a foreign AI-agent control surface. No additional exfiltration or remote payload behavior is needed for this block decision.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm install of @lsproxy/cli@0.11.4
Impact
Installs agent-facing instructions without explicit user invocation or consent during package installation.
Mechanism
postinstall copies packaged Claude skill directory to ~/.claude/skills
Policy narrative
On install, npm runs skillit-postinstall.cjs. The script reads package metadata, rewrites markdown under the packaged skills directory, creates ~/.claude/skills, and recursively copies each packaged skill directory there. That places package-supplied instructions into Claude's user-level skill surface without an explicit CLI command.
AI rationale
Although the CLI runtime behavior is largely aligned with LSP/refactoring functionality, the unguarded install-time write into ~/.claude/skills matches the policy for unconsented lifecycle mutation of a foreign AI-agent control surface. No additional exfiltration or remote payload behavior is needed for this block decision.
Evidence
package.jsonskillit-postinstall.cjsskills/lsproxy-cli/SKILL.mddist/connect.jsdist/session.jsdist/config/adapters/claude-code.jsskills/lsproxy-cli/**~/.claude/skills/lsproxy-cli/**
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- package.json defines postinstall: node ./skillit-postinstall.cjs
- skillit-postinstall.cjs runs at install time and copies packaged skills into os.homedir()/.claude/skills
- skills/lsproxy-cli/SKILL.md is package-supplied Claude skill content for invoking lsproxy commands
- skillit-postinstall.cjs mutates packaged .md files before copying them
Evidence against
- No credential harvesting or exfiltration endpoints found in inspected source
- dist/connect.js daemon behavior is user-invoked CLI/proxy functionality
- dist/session.js child_process spawn runs user-selected language server commands during CLI use
- Config adapter writes are exposed through explicit lsproxy config commands
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./sk[redacted]
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgskillit-postinstall.cjsView file
26Install-time AI-agent control hijack evidence:
L26: const updated = content.replaceAll(npxPrefix, binName);
L27: if (updated !== content) fs.writeFileSync(full, updated, 'utf8');
L28: }
...
L32: function copyDir(src, dest) {
L33: fs.mkdirSync(dest, { recursive: true });
L34: for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
...
L39: } else {
L40: fs.copyFileSync(srcPath, destPath);
L41: }
...
L46:
L47: const userSkillsDir = path.join(os.homedir(), '.claude', 'skills');
L48: try {
Payload evidence from skills/lsproxy-cli/SKILL.md:
L63: server has not loaded the full workspace project. lsproxy flags this case as `partial:true`
L64: with a `warning` (and a stderr note) instead of a bare `ok:true`. Do not treat a
L65: partial/empty result as "no callers" for a deletion or a
Critical
Ai Agent Control Hijack
Install-time source drops package-supplied AI-agent/MCP control files or instructions.
skillit-postinstall.cjsView on unpkg · L26Findings
1 Critical3 High2 Medium3 Low
CriticalAi Agent Control Hijackskillit-postinstall.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritydist/connect.js
HighKnown Malware Source Fingerprint Signaturedist/connect.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @lsproxy/cli@0.11.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @lsproxy/cli@0.11.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
8 known versions1.1.2latestSuspiciousAgent extension lifecycle riskWarnPublishedSep 24, 2026, 6:40 PM1.1.1SuspiciousAgent extension lifecycle riskWarnPublishedSep 21, 2026, 5:06 PM1.1.0SuspiciousAgent extension lifecycle riskWarnPublishedSep 2, 2026, 9:53 PM1.0.3SuspiciousAgent extension lifecycle riskWarnPublishedAug 28, 2026, 4:17 PM