Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@lsproxy/cli@1.0.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged as agent extension risk

Allowed by default with warning: install-time first-party agent extension setup was detected.

View on npm All versions Policy details

registry / @lsproxy/cli / 1.0.0

@lsproxy/cli@1.0.0

Standalone refactor CLI driving any LSP server: project-wide rename, file-move with importer updates, and code actions.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. npm postinstall creates a first-party Claude skill under the user's AI-agent skills directory. No exfiltration, remote endpoint, or arbitrary payload execution was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Adds a package-owned agent extension without an explicit setup command.

Mechanism

copies bundled Markdown skill files to ~/.claude/skills/lsproxy-cli

Rationale

This is a concrete install-time first-party agent extension lifecycle risk, not confirmed malware. The explicit CLI commands can write refactor and selected config changes, but those actions are user-invoked and bounded by the tool's stated workflow.

Evidence

package.jsonskillit-postinstall.cjsskills/lsproxy-cli/SKILL.mddist/config-command.jsdist/config/adapters/claude-code.jsskills/lsproxy-cli~/.claude/skills/lsproxy-cli

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence for warning

package.json runs skillit-postinstall.cjs on postinstall.
skillit-postinstall.cjs copies bundled skills into ~/.claude/skills/lsproxy-cli without a user command.
The installed skill directs agent use of a CLI that can apply workspace edits.

Evidence against

Postinstall has no network, shell, credential, or payload execution.
The copied content is a package-namespaced lsproxy-cli skill, not a broad config rewrite.
Claude/Codex config writes occur only through explicit lsproxy config commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 148 KB of source

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./sk[redacted]

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

skillit-postinstall.cjsView file

26const updated = content.replaceAll(npxPrefix, binName); L27: if (updated !== content) fs.writeFileSync(full, updated, 'utf8'); L28: } ... L32: function copyDir(src, dest) { L33: fs.mkdirSync(dest, { recursive: true }); L34: for (const entry of fs.readdirSync(src, { withFileTypes: true })) { ... L39: } else { L40: fs.copyFileSync(srcPath, destPath); L41: } ... L46: L47: const userSkillsDir = path.join(os.homedir(), '.claude', 'skills'); L48: try {

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

skillit-postinstall.cjsView on unpkg · L26

dist/connect.jsView file

•matchType = normalized_sha256 matchedPackage = @lsproxy/cli@0.11.4 matchedPath = dist/connect.js matchedIdentity = npm:QGxzcHJveHkvY2xp:0.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/connect.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @lsproxy/cli@1.0.1 matchedIdentity = npm:QGxzcHJveHkvY2xp:1.0.1 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/connect.jsView on unpkg

Findings

1 Critical3 High2 Medium3 Low

CriticalAi Agent Control Hijackskillit-postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/connect.js

HighPrevious Version Dangerous Deltadist/connect.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

95%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorPradeep Mouli <pmouli@mac.com> (https://github.com/pradeepmouli)

Maintainerspmouli

Version1.0.2

PublishedJul 11, 2026

LicenseMIT

Dependencies6

Integrityverified

Package size94.4 KB

Files125

Keywordslsplanguage-server-protocolrefactorrenamecodemodclitypescript

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → lsproxy

Runtimenode >=22.12.0

Artifact399 KB · 125 files1 signature(s) · provenance

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemShellHighEntropyStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

package.jsonView file

Lines 50-73json

50 "zod": "^4.4.3",

51 "@lspeasy/core": "2.7.0",

52 "@lspeasy/client": "3.1.7",

53 "@lsproxy/proxy": "1.3.0"

54 },

55 "devDependencies": {

56 "@skillit/cli": "^0.6.0",

57 "tsx": "^4.22.4",

58 "typedoc-plugin-skillit": "^1.4.1",

59 "typescript": "^6.0.3",

60 "@lspeasy/server": "4.2.1"

61 },

62 "engines": {

63 "node": ">=22.12.0"

64 },

65 "scripts": {

66 "build": "tsgo --build",

67 "clean": "rm -rf dist tsconfig.tsbuildinfo",

68 "dev": "tsgo --build --watch",

69 "type-check": "tsgo --noEmit",

70 "postinstall": "node ./skillit-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L70

71 "skill:gen": "tsx scripts/gen-skill.ts"

72 }

73}

skillit-postinstall.cjsView file

Lines 6-46javascript

6

7const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));

8const pkgName = pkg.name;

9const

dist/connect.jsView file

•matchType = normalized_sha256 matchedPackage = @lsproxy/cli@0.11.4 matchedPath = dist/connect.js matchedIdentity = npm:QGxzcHJveHkvY2xp:0.11.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/connect.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @lsproxy/cli@1.0.1 matchedIdentity = npm:QGxzcHJveHkvY2xp:1.0.1 similarity = 0.964 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/connect.jsView on unpkg

binMap

=

pkg.bin;

10if (!pkgName || !binMap || typeof binMap !== 'object' || Object.keys(binMap).length === 0) {

11 process.exit(0);

12}

13const binName = Object.keys(binMap)[0];

14const npxPrefix = 'npx ' + pkgName;

15

16const skillsDir = path.join(__dirname, 'skills');

17if (!fs.existsSync(skillsDir)) process.exit(0);

18

19function rewrite(dir) {

20 for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {

21 const full = path.join(dir, entry.name);

22 if (entry.isDirectory()) {

23 rewrite(full);

24 } else if (entry.isFile() && entry.name.endsWith('.md')) {

25 const content = fs.readFileSync(full, 'utf8');

26 const updated = content.replaceAll(npxPrefix, binName);

27 if (updated !== content) fs.writeFileSync(full, updated, 'utf8');

28 }

29 }

30}

31

32function copyDir(src, dest) {

33 fs.mkdirSync(dest, { recursive: true });

34 for (const entry of fs.readdirSync(src, { withFileTypes: true })) {

35 const srcPath = path.join(src, entry.name);

36 const destPath = path.join(dest, entry.name);

37 if (entry.isDirectory()) {

38 copyDir(srcPath, destPath);

39 } else {

40 fs.copyFileSync(srcPath, destPath);

41 }

42 }

43}

44

45rewrite(skillsDir);

46

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

skillit-postinstall.cjsView on unpkg · L26