Loading npm security reports…

@muggleai/works@5.11.1: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.11.1

@muggleai/works@5.11.1

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installation mutates Cursor’s global skills and MCP configuration without a user command. It also downloads a remote Electron binary into ~/.muggle-ai.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install, via postinstall

Impact

A newly installed MCP server and packaged skills become available to Cursor automatically.

Mechanism

global Cursor agent-control-surface injection and remote binary download

Policy narrative

The package’s npm postinstall invokes code that copies its skills into the user-wide Cursor skills directory and unconditionally writes a muggle server entry to ~/.cursor/mcp.json. This changes a foreign AI-agent control surface without an explicit setup command. The same install hook downloads and extracts an Electron binary, although it verifies a pinned checksum.

Rationale

Concrete postinstall mutation of ~/.cursor/skills and ~/.cursor/mcp.json meets the block boundary for unconsented foreign AI-agent control-surface writes. Checksum validation does not mitigate the automatic control-surface injection.

Evidence

package.jsonscripts/postinstall.mjsplugin/skills/*~/.cursor/skills/*~/.cursor/mcp.json~/.muggle-ai/electron-app/*~/.muggle-ai/install-manifest.json

Network endpoints1

/multiplex-ai/muggle-ai-works/releases/download

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-MSPMXBO5.jsView file

10import { fileURLToPath } from 'url'; L11: import { exec, spawn } from 'child_process'; L12: import axios, { AxiosError } from 'axios';

High

Child Process

Package source references child process execution.

dist/chunk-MSPMXBO5.jsView on unpkg · L10

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/chunk-MSPMXBO5.js: import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs'; var DEFAULT_PROMPT_SERVICE_PRODUCTION_URL = "https://promptservice.muggle-ai.com"; var DEFAULT_AUTH0_PRODUCTION_AUDIENCE = "https://muggleai.us.auth0.com/api/v2/"; var DEFAULT_AUTH0_DEV_AUDIENCE = "https://dev-po4mxmz0rd8a0w8w.us.auth0.com/api/v2/"; fs5.writeFileSync(apiKeyPath, content, { mode: 384 }); fs5.writeFileSync(apiKeyPath, content, { mode: 384 }); const url = `https://${domain}/oauth/device/code`; const logoutUrl = new URL(`https://${domain}/v2/logout`);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/chunk-MSPMXBO5.jsView on unpkg

dist/plugin/scripts/guard-run.mjsView file

32const bareCommandLine = buildWindowsCommandLine(input.options.command); L33: const commandLine = input.commandNeedsCmdShell ? `cmd.exe /d /s /c "${bareCommandLine}"` : bareCommandLine; L34: return {

High

Shell

Package source references shell execution.

dist/plugin/scripts/guard-run.mjsView on unpkg · L32

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L64: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.9.0 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/chunk-WUMAJOBT.jsView file

12Cross-file remote execution chain: dist/chunk-WUMAJOBT.js spawns dist/chunk-MSPMXBO5.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L582: if (inlineBytes <= opts.maxBodyBytes) { L583: return { body: inlineBody, comment: null }; L584: } ... L702: } L703: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L704: try { ... L807: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-WUMAJOBT.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.10.0 matchedPath = dist/chunk-7NC2DJTK.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-WUMAJOBT.jsView on unpkg

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 18-58json

18 "clean": "rimraf dist",

19 "build": "tsup && node scripts/strip-telemetry-comments.mjs && node scripts/write-release-manifest.mjs && node scripts/sync-versions.mjs && node scripts/build-plugin.mjs",

20 "build:plugin": "node scripts/build-plugin.mjs",

21 "sync:versions": "node scripts/sync-versions.mjs",

22 "build:release": "npm run build",

23 "verify:plugin": "node scripts/verify-plugin-marketplace.mjs",

24 "verify:contracts": "node scripts/verify-compatibility-contracts.mjs",

25 "verify:skill-deps": "node scripts/check-skill-deps.mjs",

26 "verify:signatures": "node scripts/check-post-signatures.mjs",

27 "smoke:cli": "node scripts/smoke-cli.mjs",

28 "verify:electron-release-checksums": "node scripts/verify-electron-release-checksums.mjs",

29 "verify:upgrade-experience": "node scripts/verify-upgrade-experience.mjs",

30 "link:maintainer-skills": "node scripts/link-maintainer-skills.mjs",

31 "build:workspace": "turbo run build",

32 "typecheck:workspace": "turbo run typecheck",

33 "lint:workspace": "turbo run lint",

34 "test:workspace": "turbo run test",

35 "dev:workspace": "turbo run dev",

36 "bootstrap": "npm install && npm run build",

37 "bootstrap:workspace": "pnpm install && pnpm run build:workspace",

38 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "start": "node dist/index.js",

40 "dev": "tsx watch src/index.ts",

41 "lint": "eslint . --fix",

42 "lint:check": "eslint .",

43 "typecheck": "tsc --noEmit",

44 "test": "vitest run",

45 "test:watch": "vitest",

46 "test:gates:behavioral": "tsx internal/skill-gate-eval/src/run.ts",

47 "test:agents:behavioral": "tsx internal/agent-gate-eval/src/run.ts",

48 "eval:studio-gen": "tsx internal/studio-gen-eval/src/run.ts"

49 },

50 "muggleConfig": {

51 "electronAppVersion": "1.9.0",

52 "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",

53 "runtimeTargetDefault": "production",

54 "checksums": {

55 "darwin-arm64": "1baa38bde71b74984705bcac3e5a42a7a158a7b0574dab496f3e240846c0ac65",

56 "darwin-x64": "098cc2db6f32c7857bd933512320524d213804b378dc8bf0ade791396f058041",

57 "linux-x64": "d434a88a087c7410785a443cfe03102322fa7a295b77600f5ed92e2113e271c2",

58 "win32-x64": "0aecbc01010ab0a268137ed31bcaaa05fe9215daa9f4c0e4871b07554d28c0c8"

dist/chunk-MSPMXBO5.jsView file

Lines 1-30javascript

1import * as crypto from 'crypto';

2import { randomUUID } from 'crypto';

3import * as fs5 from 'fs';

dist/plugin/scripts/guard-run.mjsView file

Lines 12-52javascript

12 let backslashCount = 0;

13 for (const character of argument) {

14 if (character === "\\") {

scripts/postinstall.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/* global AbortController */

3/**

4 * Postinstall script for @muggleai/works.

5 * Downloads the Electron app binary for local testing.

6 * Output is written to both console and ~/.muggle-ai/postinstall.log

7 */

8

9import { createHash } from "crypto";

10

dist/chunk-WUMAJOBT.jsView file

Lines 1-32javascript

1import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, ...

2import { Server } from '@modelcontextprotocol/sdk/server/index.js';

3import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';

4import { v4 } from

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg