Loading npm security reports…

@muggleai/works@5.13.1: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.13.1

@muggleai/works@5.13.1

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies Cursor's user-wide skills and MCP configuration. It registers a command that can be started by the AI-agent host.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

A package install can alter the user's Cursor agent configuration and make the package command available as an MCP server.

Mechanism

Automatic mutation of a foreign AI-agent control surface.

Policy narrative

On npm installation, the postinstall script copies package-controlled skills into the user's Cursor skills directory and rewrites the user-wide Cursor MCP configuration to register `muggle serve`. These actions occur without an explicit setup command and change an external AI-agent control surface. The same hook also downloads an Electron binary to the user's home directory.

Rationale

This is an unconsented postinstall mutation of a foreign, user-wide AI-agent control surface. Integrity checks on the downloaded binary do not mitigate the automatic Cursor configuration and skill installation.

Evidence

package.jsonscripts/postinstall.mjs~/.cursor/skills/<muggle skill>~/.cursor/mcp.json~/.muggle-ai

Network endpoints1

github.com

Decision evidence

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-7WL6LFIU.jsView file

14import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises';

High

Child Process

Package source references child process execution.

dist/chunk-7WL6LFIU.jsView on unpkg · L14

1845execFile( L1846: "powershell", L1847: ["-command", `Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force`],

High

Shell

Package source references shell execution.

dist/chunk-7WL6LFIU.jsView on unpkg · L1845

12Cross-file remote execution chain: dist/chunk-7WL6LFIU.js spawns dist/chunk-H5UDFKG3.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L584: if (inlineBytes <= opts.maxBodyBytes) { L585: return { body: inlineBody, comment: null }; L586: } ... L704: } L705: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L706: try { ... L809: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-7WL6LFIU.jsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/chunk-TWRBO35Z.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-7WL6LFIU.jsView on unpkg

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L69: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

config/runtime-targets.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

config/runtime-targets.jsonView on unpkg

dist/chunk-H5UDFKG3.jsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/chunk-H5UDFKG3.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-H5UDFKG3.jsView on unpkg

dist/plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrail-record-comment-replies.shView on unpkg

dist/plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/pr-watch-arm.shView on unpkg

plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrail-record-comment-replies.shView on unpkg

plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/pr-watch-arm.shView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 20-60json

20 "clean": "rimraf dist",

21 "build": "tsup && node scripts/strip-telemetry-comments.mjs && node scripts/write-release-manifest.mjs && node scripts/sync-versions.mjs && node scripts/build-plugin.mjs",

22 "build:plugin": "node scripts/build-plugin.mjs",

23 "sync:versions": "node scripts/sync-versions.mjs",

24 "build:release": "npm run build",

25 "verify:plugin": "node scripts/verify-plugin-marketplace.mjs",

26 "verify:contracts": "node scripts/verify-compatibility-contracts.mjs",

27 "verify:skill-deps": "node scripts/check-skill-deps.mjs",

28 "verify:signatures": "node scripts/check-post-signatures.mjs",

29 "smoke:cli": "node scripts/smoke-cli.mjs",

30 "verify:electron-release-checksums": "node scripts/verify-electron-release-checksums.mjs",

31 "verify:upgrade-experience": "node scripts/verify-upgrade-experience.mjs",

32 "link:maintainer-skills": "node scripts/link-maintainer-skills.mjs",

33 "build:workspace": "turbo run build",

34 "typecheck:workspace": "turbo run typecheck",

35 "lint:workspace": "turbo run lint",

36 "test:workspace": "turbo run test",

37 "dev:workspace": "turbo run dev",

38 "bootstrap": "npm install && npm run build",

39 "bootstrap:workspace": "pnpm install && pnpm run build:workspace",

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "start": "node dist/index.js",

42 "dev": "tsx watch src/index.ts",

43 "lint": "eslint . --fix",

44 "lint:check": "eslint .",

45 "typecheck": "tsc --noEmit",

46 "test": "vitest run",

47 "test:watch": "vitest",

48 "test:gates:behavioral": "tsx internal/skill-gate-eval/src/run.ts",

49 "test:agents:behavioral": "tsx internal/agent-gate-eval/src/run.ts",

50 "eval:studio-gen": "tsx internal/studio-gen-eval/src/run.ts",

51 "typecheck:browser-bench": "tsc --noEmit -p internal/browser-bench/tsconfig.json"

52 },

53 "muggleConfig": {

54 "electronAppVersion": "1.10.3",

55 "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",

56 "runtimeTargetDefault": "production",

57 "checksumsByStream": {

58 "production": {

59 "win32-x64": "58e2238b1609ceff65b836b4b724b1c4c341d737a15debaa8a71af21b70bc436",

60 "linux-x64": "731c2ab093ef77202191d0fec8e98f19ef895019d3e7817bacef197c7197a358",

dist/chunk-7WL6LFIU.jsView file

Lines 1-34javascript

1import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assert ...

2import { Server } from '@modelcontextprotocol/sdk/server/index.js';

3import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';

4import { v4 } from

scripts/postinstall.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/* global AbortController */

3/**

4 * Postinstall script for @muggleai/works.

5 * Downloads the Electron app binary for local testing.

6 * Output is written to both console and ~/.muggle-ai/postinstall.log

7 */

8

9import { createHash } from "crypto";

10

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

config/runtime-targets.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

config/runtime-targets.jsonView on unpkg

dist/chunk-H5UDFKG3.jsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/chunk-H5UDFKG3.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-H5UDFKG3.jsView on unpkg

dist/plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrail-record-comment-replies.shView on unpkg

dist/plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/pr-watch-arm.shView on unpkg

plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrail-record-comment-replies.shView on unpkg

plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.0 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/pr-watch-arm.shView on unpkg