Loading npm security reports…

@mark-gozner/aigile-method@1.5.1: Malicious npm security report | LPM Firewall

registry / @mark-gozner/aigile-method / 1.5.1

@mark-gozner/aigile-method@1.5.1

AIgile Development Method by Mark Gozner - AI-powered development with custom agents (Claude Code, GitHub Copilot, Google Antigravity & Kiro), skills, workflows, handoffs, and delegation

AI Security Review

scanned 19d ago · by lpm-firewall-ai

npm postinstall automatically runs a noninteractive installer in the consumer project. It detects and writes AI-agent configuration and package commands without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package through npm, unless the environment opt-out is already set.

Impact

It can alter project AI-agent behavior, instructions, subagents, skills, and npm scripts during dependency installation.

Mechanism

Postinstall-driven AI-agent control-surface mutation.

Attack narrative

On installation, the postinstall hook spawns the package CLI with install --yes in the consuming project. The CLI detects existing AI-agent platforms and installs package-supplied agents and instructions into their project control surfaces. It also adds scripts to the consumer package manifest by default. This is an unconsented install-time mutation of broad, behavior-bearing AI-agent configuration.

AI rationale

The automatic lifecycle hook mutates consumer AI-agent control surfaces and project metadata without an explicit user setup action. This meets the install-hook abuse blocking policy even though no credential exfiltration was confirmed.

Evidence

package.jsontools/postinstall.jstools/cli.js.aigile-core/.github/agents/.agent/rules/.agent/workflows/GEMINI.md.claude/agents/.claude/skills/CLAUDE.md.claude/settings.json.vscode/settings.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node tools/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node tools/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

tools/cli.jsView file

8const __filename = fileURLToPath(import.meta.url); L9: const __dirname = path.dirname(__filename); L10: const root = path.resolve(__dirname, '..'); ... L19: if (cachedPkgVersion) return cachedPkgVersion; L20: const pkgPath = path.join(root, 'package.json'); L21: try { L22: const raw = read(pkgPath); L23: const json = JSON.parse(raw); L24: cachedPkgVersion = json.version || '0.0.0'; ... L133: function getUserHome() { L134: return process.env.HOME || process.env.USERPROFILE || process.env.USERDIR || process.cwd(); L135: }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

tools/cli.jsView on unpkg · L8

8Trigger-reachable chain: manifest.bin -> tools/cli.js L8: const __filename = fileURLToPath(import.meta.url); L9: const __dirname = path.dirname(__filename); L10: const root = path.resolve(__dirname, '..'); ... L19: if (cachedPkgVersion) return cachedPkgVersion; L20: const pkgPath = path.join(root, 'package.json'); L21: try { L22: const raw = read(pkgPath); L23: const json = JSON.parse(raw); L24: cachedPkgVersion = json.version || '0.0.0'; ... L133: function getUserHome() { L134: return process.env.HOME || process.env.USERPROFILE || process.env.USERDIR || process.cwd(); L135: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

tools/cli.jsView on unpkg · L8

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. tools/cli.js: import { createInterface, emitKeypressEvents } from 'node:readline'; function write(p, c) { fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, c, 'utf8'); } fs.writeFileSync(npmrcPath, content, 'utf8'); if (fs.existsSync(path.join(dest, '.claude')) || fs.existsSync(path.join(dest, 'CLAUDE.md'))) found.push('claude'); if ((process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT) && !found.includes('claude')) found.push('claude'); target.claude && 'claude', { label: 'Claude Code (.claude/agents/ + .claude/skills/ + CLAUDE.md)', value: 'claude' }, if (addMcpJson) console.log(` - ${yellow('.vscode/m

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

tools/cli.jsView on unpkg

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. []; let steeringcount = 0; if (fs.existssync(agentssrcdir)) { const files = fs.readdirsync(agentssrcdir).filter(f => f.endswith('.md')); const agentmap = new map(); for (const f of files) { const isnativeagent = f.endswith('.agent.md'); const agentid = isnativeagent ? f.replace(/\.agent\.md$/, '') : f.replace(/\.[^/.]+$/, ''); if (!agentmap.has(agentid)) { agentmap.set(agentid, f); } else if (!isnativeagent && agentmap.get(agentid).endswith('.agent.md')) { agentmap.set(agentid, f); } } for (const agentid of array.from(agentmap.keys

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

tools/cli.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 6-46json

6 "license": "SEE LICENSE",

7 "bin": {

8 "aigile": "tools/cli.js",

9 "aigile-method": "tools/cli.js"

10 },

11 "type": "module",

12 "engines": {

13 "node": ">=18"

14 },

15 "scripts": {

16 "bundle": "node tools/cli.js bundle",

17 "build": "node tools/cli.js bundle",

18 "validate": "node tools/cli.js bundle && node tools/validate-bundles.js",

19 "prepublishOnly": "npm run build",

20 "pack:dry-run": "npm pack --dry-run",

21 "release:patch": "npm version patch && npm publish",

22 "release:minor": "npm version minor && npm publish",

23 "release:major": "npm version major && npm publish",

24 "list:agents": "node -e \"const fs=require('fs'); const p=require('path'); const d=p.join('core','agents'); console.log('Available agents:'); if(fs.existsSync(d)) for(const f of fs.readdirSync(d)) if(f.endsWith('.md')) console.log(' - '+f.replace(/\\.md$/, ''));\"",

25 "install:aigile": "node tools/cli.js install",

26 "postinstall": "node tools/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "aigile:install": "aigile-method install --yes",

28 "aigile:bundle": "aigile-method bundle",

29 "aigile:status": "aigile-method status",

30 "aigile:list": "aigile-method list:agents",

31 "aigile:plugin": "node tools/cli.js bundle"

32 },

33 "keywords": [

34 "claude-code-plugin",

35 "subagents",

36 "anthropic",

37 "claude",

38 "claude-code",

39 "kiro",

40 "kiro-ide",

41 "agent-skills",

42 "skills",

43 "steering",

44 "antigravity",

45 "gemini",

46 "agentic",

tools/cli.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import fs from 'node:fs';

3import path from 'node:path';

4import { fileURLToPath } from 'node:url';

5import { createInterface, emitKeypressEvents } from