@montytools/cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@montytools/cli: Suspicious npm security report (Warn) | LPM Firewall

bin/monty.mjsView file

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/monty.mjsView on unpkg · L5

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/monty.mjs: import { appendFileSync, closeSync, cpSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, symlinkSync, writeFileSync, readdirSync, statSync, existsSync } from "n... const DEFAULT_HOST = "https://usemonty.dev"; writeFileSync( writeFileSync( writeFileSync(GLOBAL_SKILLS_MARKER, CLI_VERSION + "\n"); writeFileSync(marker, CLI_VERSION + "\n"); writeFileSync(join(dir, ".monty", "app.json"), JSON.stringify(next, null, 2) + "\n"); // Pack the app's source tree (node_modules/dist/.monty/.git excluded) into a

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/monty.mjsView on unpkg

5L6: import { spawn, spawnSync } from "node:child_process"; L7: import { createHash, randomBytes } from "node:crypto"; ... L10: import { StringDecoder } from "node:string_decoder"; L11: import { createServer } from "node:http"; L12: import { connect as netConnect } from "node:net"; ... L26: // custom root is a sandbox: the legacy visible home (~/Monty) is not scanned. L27: const CONFIG_DIR = process.env.MONTY_HOME L28: ? resolve(process.env.MONTY_HOME) L29: : join(homedir(), ".monty"); L30: const CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L104: try {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/monty.mjsView on unpkg · L5

249try { L250: spawn(cmd, args, { stdio: "ignore", detached: true }).unref(); L251: } catch { ... L259: // The build skill ships inside this package. Primary installer is the L260: // cross-agent standard `npx skills add` (same as InsForge) which fans out to L261: // every agent's folder — Claude Code, Codex (.agents/skills), Cursor, etc.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/monty.mjsView on unpkg · L249

bin/postinstall.mjsView file

1// Best-effort: put the agent build skill where Claude Code looks for it L2: // (~/.claude/skills) as soon as the package lands. Never fails the install; L3: // set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time. L4: import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs"; L5: import { homedir } from "node:os"; ... L14: const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version; L15: const target = join(homedir(), ".claude", "skills"); L16: mkdirSync(target, { recursive: true }); L17: for (const name of readdirSync(src)) { L18: cpSync(join(src, name), join(target, name), { recursive: true }); L19: writeFileSync(join(target, name, "VERSION"), version + "\n"); L20: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join } from "node:path"; import { fileurltopath } from "node:url"; try { if (process.env.monty_no_skills || process.env.ci) process.exit(0); const root = join(dirname(fileurltopath(import.meta.url)), ".."); const src = join(root, "skills"); if (!existssync(src)) process.exit(0); const version = json.parse(readfilesync(join(root, "package.json"), "utf8")).version; const target = join(homedir(), ".claude", "skills"); mkdirsync(target, { recursive: true }); for (const name of readdirsync(src)) { cpsync(join(src,

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.mjsView on unpkg

bin/monty.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// monty — the Monty platform CLI. Output is agent-shaped: structured

3// single-line events, no spinners, instruction-shaped errors, and a

4// deterministic final line (`saved: …` / `error: …`).

5

6import { spawn, spawnSync } from "node:child_process";

7import { createHash, randomBytes } from "node:crypto";

High

Child Process

Package source references child process execution.

bin/monty.mjsView on unpkg · L5

8import { appendFileSync, closeSync, cpSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, symlinkSync, writeFileSync, readdirSync, statSync, existsSync } from "node:fs";

9import { createRequire } from "node:module";

10import { StringDecoder } from "node:string_decoder";

11import { createServer } from "node:http";

12import { connect as netConnect } from "node:net";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/monty.mjsView on unpkg · L5

13import { homedir } from "node:os";

14import { basename, dirname, join, relative, resolve } from "node:path";

15import { fileURLToPath } from "node:url";

16import { createInterface } from "node:readline/promises";

17import { CATALOG, REGISTRIES } from "./catalog.mjs";

18import { CompileError, compileAppConfig } from "../lib/compile.mjs";

19import { manifestHash } from "../lib/schemaCodegen.mjs";

20import { readSchemaState, schemaPull, writeSchemaState } from "../lib/schemaPull.mjs";

21

22// MONTY_HOME overrides the state root (default ~/.monty): config.json,

23// apps/, and desktop.json all live under it. This is how a second, isolated

24// Monty state coexists on one machine — the desktop's dev channel points it

25// at ~/.monty-dev so platform development never touches the real state. A

Lines 229-269javascript

229

230 server.listen(0, "127.0.0.1", () => {

231 const { port } = server.address();

232 const authUrl = `${host}/cli-auth?redirect=${

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/monty.mjs: import { appendFileSync, closeSync, cpSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, symlinkSync, writeFileSync, readdirSync, statSync, existsSync } from "n... const DEFAULT_HOST = "https://usemonty.dev"; writeFileSync( writeFileSync( writeFileSync(GLOBAL_SKILLS_MARKER, CLI_VERSION + "\n"); writeFileSync(marker, CLI_VERSION + "\n"); writeFileSync(join(dir, ".monty", "app.json"), JSON.stringify(next, null, 2) + "\n"); // Pack the app's source tree (node_modules/dist/.monty/.git excluded) into a

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/monty.mjsView on unpkg

bin/postinstall.mjsView file

Lines 1-21javascript

1// Best-effort: put the agent build skill where Claude Code looks for it

2// (~/.claude/skills) as soon as the package lands. Never fails the install;

3// set MONTY_NO_SKILLS=1 to opt out. `monty skills` re-runs this any time.

4import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

5import { homedir } from "node:os";

6import { dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

8

9try {

10 if (process.env.MONTY_NO_SKILLS || process.env.CI) process.exit(0);

11 const root = join(dirname(fileURLToPath(import.meta.url)), "..");

12 const src = join(root, "skills");

13 if (!existsSync(src)) process.exit(0);

14 const version = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version;

15 const target = join(homedir(), ".claude", "skills");

16 mkdirSync(target, { recursive: true });

17 for (const name of readdirSync(src)) {

18 cpSync(join(src, name), join(target, name), { recursive: true });

19 writeFileSync(join(target, name, "VERSION"), version + "\n");

20 }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.mjsView on unpkg · L1

21 console.log(`monty: agent skill installed (~/.claude/skills, v${version})`);

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import { cpsync, existssync, mkdirsync, readfilesync, readdirsync, writefilesync } from "node:fs"; import { homedir } from "node:os"; import { dirname, join } from "node:path"; import { fileurltopath } from "node:url"; try { if (process.env.monty_no_skills || process.env.ci) process.exit(0); const root = join(dirname(fileurltopath(import.meta.url)), ".."); const src = join(root, "skills"); if (!existssync(src)) process.exit(0); const version = json.parse(readfilesync(join(root, "package.json"), "utf8")).version; const target = join(homedir(), ".claude", "skills"); mkdirsync(target, { recursive: true }); for (const name of readdirsync(src)) { cpsync(join(src,

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.mjsView on unpkg