Loading npm security reports…

@muggleai/works@5.13.0: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.13.0

@muggleai/works@5.13.0

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm installation changes the user's global Cursor AI configuration and installs package-controlled skills. It also downloads and extracts an Electron application automatically.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package, including dependency installation that permits postinstall scripts.

Impact

It can cause Cursor to invoke the package's muggle command and load package-provided skills without a separate user setup action.

Mechanism

Automatic AI-agent configuration mutation and remote binary installation.

Policy narrative

The manifest invokes scripts/postinstall.mjs during installation. The hook overwrites matching global Cursor skill directories, copies package skills there, and writes a muggle server entry to ~/.cursor/mcp.json. It then downloads an Electron archive from GitHub releases. This is an unconsented install-time mutation of a broad AI-agent control surface, even though the binary download has integrity checks.

Rationale

The automatic postinstall hook modifies global Cursor agent configuration and skills, rather than requiring an explicit user setup action. This meets the install-hook abuse boundary for a publish block.

Evidence

package.jsonscripts/postinstall.mjs~/.cursor/mcp.json~/.cursor/skills/muggle-*~/.muggle-ai/electron-app/<version>

Network endpoints1

github.com

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-TWRBO35Z.jsView file

14import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises';

High

Child Process

Package source references child process execution.

dist/chunk-TWRBO35Z.jsView on unpkg · L14

1845execFile( L1846: "powershell", L1847: ["-command", `Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force`],

High

Shell

Package source references shell execution.

dist/chunk-TWRBO35Z.jsView on unpkg · L1845

12Cross-file remote execution chain: dist/chunk-TWRBO35Z.js spawns dist/chunk-H5UDFKG3.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L584: if (inlineBytes <= opts.maxBodyBytes) { L585: return { body: inlineBody, comment: null }; L586: } ... L704: } L705: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L706: try { ... L809: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-TWRBO35Z.jsView on unpkg · L12

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L69: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

config/runtime-targets.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

config/runtime-targets.jsonView on unpkg

dist/chunk-H5UDFKG3.jsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/chunk-H5UDFKG3.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-H5UDFKG3.jsView on unpkg

dist/plugin/scripts/guardrails.mjsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/plugin/scripts/guardrails.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrails.mjsView on unpkg

plugin/scripts/guardrails.mjsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/plugin/scripts/guardrails.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrails.mjsView on unpkg

dist/plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrail-record-comment-replies.shView on unpkg

dist/plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/pr-watch-arm.shView on unpkg

plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrail-record-comment-replies.shView on unpkg

plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.12.0 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.12.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/pr-watch-arm.shView on unpkg