Loading npm security reports…

@muggleai/works@5.12.0: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.12.0

@muggleai/works@5.12.0

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation automatically changes the user's global Cursor MCP control file and installs skills. It also downloads and extracts a remote Electron application into the home directory.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the package with npm lifecycle scripts enabled.

Impact

Cursor is configured to launch the package's MCP server without a separate setup action, expanding an AI-agent control surface.

Mechanism

Postinstall mutation of Cursor agent configuration plus remote binary download.

Policy narrative

On npm installation, the postinstall script copies skills into the user's Cursor directory and writes a muggle MCP server entry to ~/.cursor/mcp.json. This globally enables Cursor to invoke `muggle serve` without an explicit configuration command. The same automatic hook downloads and extracts an Electron application under ~/.muggle-ai.

Rationale

This is an unconsented install-time mutation of a broad AI-agent control surface. Integrity checks on the downloaded application do not remove the configuration-hijack behavior.

Evidence

package.jsonscripts/postinstall.mjs~/.cursor/mcp.json~/.cursor/skills~/.muggle-ai/electron-app~/.muggle-ai/electron-app/<version>

Network endpoints1

github.com

Decision evidence

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-APXAF244.jsView file

14import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises';

High

Child Process

Package source references child process execution.

dist/chunk-APXAF244.jsView on unpkg · L14

1845execFile( L1846: "powershell", L1847: ["-command", `Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force`],

High

Shell

Package source references shell execution.

dist/chunk-APXAF244.jsView on unpkg · L1845

12Cross-file remote execution chain: dist/chunk-APXAF244.js spawns dist/chunk-H5UDFKG3.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L584: if (inlineBytes <= opts.maxBodyBytes) { L585: return { body: inlineBody, comment: null }; L586: } ... L704: } L705: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L706: try { ... L809: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-APXAF244.jsView on unpkg · L12

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L69: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

config/runtime-targets.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

config/runtime-targets.jsonView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 20-60json

20 "clean": "rimraf dist",

21 "build": "tsup && node scripts/strip-telemetry-comments.mjs && node scripts/write-release-manifest.mjs && node scripts/sync-versions.mjs && node scripts/build-plugin.mjs",

22 "build:plugin": "node scripts/build-plugin.mjs",

23 "sync:versions": "node scripts/sync-versions.mjs",

24 "build:release": "npm run build",

25 "verify:plugin": "node scripts/verify-plugin-marketplace.mjs",

26 "verify:contracts": "node scripts/verify-compatibility-contracts.mjs",

27 "verify:skill-deps": "node scripts/check-skill-deps.mjs",

28 "verify:signatures": "node scripts/check-post-signatures.mjs",

29 "smoke:cli": "node scripts/smoke-cli.mjs",

30 "verify:electron-release-checksums": "node scripts/verify-electron-release-checksums.mjs",

31 "verify:upgrade-experience": "node scripts/verify-upgrade-experience.mjs",

32 "link:maintainer-skills": "node scripts/link-maintainer-skills.mjs",

33 "build:workspace": "turbo run build",

34 "typecheck:workspace": "turbo run typecheck",

35 "lint:workspace": "turbo run lint",

36 "test:workspace": "turbo run test",

37 "dev:workspace": "turbo run dev",

38 "bootstrap": "npm install && npm run build",

39 "bootstrap:workspace": "pnpm install && pnpm run build:workspace",

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "start": "node dist/index.js",

42 "dev": "tsx watch src/index.ts",

43 "lint": "eslint . --fix",

44 "lint:check": "eslint .",

45 "typecheck": "tsc --noEmit",

46 "test": "vitest run",

47 "test:watch": "vitest",

48 "test:gates:behavioral": "tsx internal/skill-gate-eval/src/run.ts",

49 "test:agents:behavioral": "tsx internal/agent-gate-eval/src/run.ts",

50 "eval:studio-gen": "tsx internal/studio-gen-eval/src/run.ts",

51 "typecheck:browser-bench": "tsc --noEmit -p internal/browser-bench/tsconfig.json"

52 },

53 "muggleConfig": {

54 "electronAppVersion": "1.9.0",

55 "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",

56 "runtimeTargetDefault": "production",

57 "checksumsByStream": {

58 "production": {

59 "darwin-arm64": "1baa38bde71b74984705bcac3e5a42a7a158a7b0574dab496f3e240846c0ac65",

60 "darwin-x64": "098cc2db6f32c7857bd933512320524d213804b378dc8bf0ade791396f058041",

dist/chunk-APXAF244.jsView file

Lines 1-34javascript

1import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assert ...

2import { Server } from '@modelcontextprotocol/sdk/server/index.js';

3import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';

4import { v4 } from

scripts/postinstall.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/* global AbortController */

3/**

4 * Postinstall script for @muggleai/works.

5 * Downloads the Electron app binary for local testing.

6 * Output is written to both console and ~/.muggle-ai/postinstall.log

7 */

8

9import { createHash } from "crypto";

10

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

config/runtime-targets.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

config/runtime-targets.jsonView on unpkg