registry / Install hook abuse / @mark-gozner/aigile-method
@mark-gozner/aigile-method
AIgile Development Method by Mark Gozner - AI-powered development with custom agents (Claude Code, GitHub Copilot, Google Antigravity & Kiro), skills, workflows, handoffs, and delegation
This report shows the evidence for @mark-gozner/aigile-method@1.5.1, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic lifecycle hook mutates consumer AI-agent control surfaces and project metadata without an explicit user setup action. This meets the install-hook abuse blocking policy even though no credential exfiltration was confirmed.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package through npm, unless the environment opt-out is already set.
Impact
It can alter project AI-agent behavior, instructions, subagents, skills, and npm scripts during dependency installation.
Mechanism
Postinstall-driven AI-agent control-surface mutation.
Attack narrative
On installation, the postinstall hook spawns the package CLI with install --yes in the consuming project. The CLI detects existing AI-agent platforms and installs package-supplied agents and instructions into their project control surfaces. It also adds scripts to the consumer package manifest by default. This is an unconsented install-time mutation of broad, behavior-bearing AI-agent configuration.
AI rationale
The automatic lifecycle hook mutates consumer AI-agent control surfaces and project metadata without an explicit user setup action. This meets the install-hook abuse blocking policy even though no credential exfiltration was confirmed.
Evidence
package.jsontools/postinstall.jstools/cli.js.aigile-core/.github/agents/.agent/rules/.agent/workflows/GEMINI.md.claude/agents/.claude/skills/CLAUDE.md.claude/settings.json.vscode/settings.json
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package registers a postinstall lifecycle hook that runs automatically on npm installation.
- The postinstall hook launches the CLI in the consuming project's directory with install --yes.
- The noninteractive installer detects existing AI-agent directories and targets them without a prompt.
- The installer copies package content and creates AI-agent controls, including Claude agents, skills, project instructions, and settings.
- The lifecycle path modifies the consumer's package.json to add commands unless an opt-out environment variable is set.
Evidence against
- No credential collection or network send is present in the inspected postinstall execution path.
- The external network code found in the CLI is not reached by the default postinstall arguments.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node tools/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node tools/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgtools/cli.jsView file
8const __filename = fileURLToPath(import.meta.url);
L9: const __dirname = path.dirname(__filename);
L10: const root = path.resolve(__dirname, '..');
...
L19: if (cachedPkgVersion) return cachedPkgVersion;
L20: const pkgPath = path.join(root, 'package.json');
L21: try {
L22: const raw = read(pkgPath);
L23: const json = JSON.parse(raw);
L24: cachedPkgVersion = json.version || '0.0.0';
...
L133: function getUserHome() {
L134: return process.env.HOME || process.env.USERPROFILE || process.env.USERDIR || process.cwd();
L135: }
Findings
2 Critical3 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationtools/cli.js
CriticalTrigger Reachable Dangerous Capabilitytools/cli.js
HighInstall Time Lifecycle Scriptspackage.json
HighCredential Redirect Persistencetools/cli.js
HighTrigger Reachable External Ai Agent Control Surface Mutationtools/cli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @mark-gozner/aigile-method@1.5.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mark-gozner/aigile-method@1.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.