Loading npm security reports…

@muggleai/works@5.10.0: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.10.0

@muggleai/works@5.10.0

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically mutates Cursor’s user-wide MCP configuration, enabling this package’s server for future agent sessions. It also downloads a verified external Electron application during installation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

A package install changes a broad AI-agent control surface without an explicit user setup command.

Mechanism

unconsented Cursor MCP configuration upsert and binary download

Policy narrative

On npm installation, scripts/postinstall.mjs creates or overwrites the muggle entry in ~/.cursor/mcp.json with a command that starts the package’s MCP server. This activates a user-wide Cursor agent integration without the user running setup. The hook also fetches and extracts a platform Electron app into ~/.muggle-ai; checksums reduce tampering risk but do not remove the unconsented agent-control mutation.

Rationale

Direct inspection confirms an unconditional postinstall write to a foreign, user-wide AI-agent MCP configuration. This meets the install-time agent-control-hijack block boundary.

Evidence

package.jsonscripts/postinstall.mjsdist/chunk-7NC2DJTK.js~/.cursor/mcp.json~/.muggle-ai/electron-app~/.muggle-ai/postinstall.log

Network endpoints1

github.com/multiplex-ai/muggle-ai-works/releases/download

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-7NC2DJTK.jsView file

14import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises';

High

Child Process

Package source references child process execution.

dist/chunk-7NC2DJTK.jsView on unpkg · L14

1761execFile( L1762: "powershell", L1763: ["-command", `Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force`],

High

Shell

Package source references shell execution.

dist/chunk-7NC2DJTK.jsView on unpkg · L1761

12Cross-file remote execution chain: dist/chunk-7NC2DJTK.js spawns dist/chunk-OCLMXAVJ.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L582: if (inlineBytes <= opts.maxBodyBytes) { L583: return { body: inlineBody, comment: null }; L584: } ... L702: } L703: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L704: try { ... L807: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-7NC2DJTK.jsView on unpkg · L12

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L64: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 2326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 17-57json

17 "scripts": {

18 "clean": "rimraf dist",

19 "build": "tsup && node scripts/strip-telemetry-comments.mjs && node scripts/write-release-manifest.mjs && node scripts/sync-versions.mjs && node scripts/build-plugin.mjs",

20 "build:plugin": "node scripts/build-plugin.mjs",

21 "sync:versions": "node scripts/sync-versions.mjs",

22 "build:release": "npm run build",

23 "verify:plugin": "node scripts/verify-plugin-marketplace.mjs",

24 "verify:contracts": "node scripts/verify-compatibility-contracts.mjs",

25 "verify:skill-deps": "node scripts/check-skill-deps.mjs",

26 "smoke:cli": "node scripts/smoke-cli.mjs",

27 "verify:electron-release-checksums": "node scripts/verify-electron-release-checksums.mjs",

28 "verify:upgrade-experience": "node scripts/verify-upgrade-experience.mjs",

29 "link:maintainer-skills": "node scripts/link-maintainer-skills.mjs",

30 "build:workspace": "turbo run build",

31 "typecheck:workspace": "turbo run typecheck",

32 "lint:workspace": "turbo run lint",

33 "test:workspace": "turbo run test",

34 "dev:workspace": "turbo run dev",

35 "bootstrap": "npm install && npm run build",

36 "bootstrap:workspace": "pnpm install && pnpm run build:workspace",

37 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "start": "node dist/index.js",

39 "dev": "tsx watch src/index.ts",

40 "lint": "eslint . --fix",

41 "lint:check": "eslint .",

42 "typecheck": "tsc --noEmit",

43 "test": "vitest run",

44 "test:watch": "vitest",

45 "test:gates:behavioral": "tsx internal/skill-gate-eval/src/run.ts",

46 "test:agents:behavioral": "tsx internal/agent-gate-eval/src/run.ts",

47 "eval:studio-gen": "tsx internal/studio-gen-eval/src/run.ts"

48 },

49 "muggleConfig": {

50 "electronAppVersion": "1.8.0",

51 "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",

52 "runtimeTargetDefault": "production",

53 "checksums": {

54 "darwin-arm64": "38a2a9c392c7c4e55bf510dbcdcf31713db341b35218759961d2672fa8eb6d20",

55 "darwin-x64": "687dd81c3fe808109e11e8db0cea8bb9c1dc05717f9f35699cf64081b591b7bd",

56 "linux-x64": "a7fad7a5370066c338916a5cf54851212bd49e36371ed62dd1f0b70349229d67",

57 "win32-x64": "803aa0690b1047e16bbe5239911d7de3751b6bf2ae8730db75e16da08b778148"

dist/chunk-7NC2DJTK.jsView file

Lines 1-34javascript

1import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, ...

2import { Server } from '@modelcontextprotocol/sdk/server/index.js';

3import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';

4import { v4 } from

scripts/postinstall.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/* global AbortController */

3/**

4 * Postinstall script for @muggleai/works.

5 * Downloads the Electron app binary for local testing.

6 * Output is written to both console and ~/.muggle-ai/postinstall.log

7 */

8

9import { createHash } from "crypto";

10

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 2326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg