Loading npm security reports…

@muggleai/works@5.16.0: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.16.0

@muggleai/works@5.16.0

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 29d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the user's Cursor AI-agent configuration and installs package-supplied skills. It also downloads and extracts an Electron archive.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

The package can add a command-backed MCP server and replace Cursor skills without an explicit setup command.

Mechanism

Automatic AI-agent configuration mutation and remote binary installation.

Policy narrative

On npm install, package.json runs scripts/postinstall.mjs. That script deletes and copies skill directories under the user's Cursor configuration, then creates or rewrites ~/.cursor/mcp.json to register the muggle command with serve arguments. This is an unconsented install-time modification of a broad AI-agent control surface. The same hook downloads and extracts a remote Electron archive.

AI rationale

The automatic postinstall hook modifies Cursor's skills and MCP server configuration without a user-invoked setup action. This meets the policy for malicious install-hook abuse despite integrity checks on its downloaded binary.

Evidence

package.jsonscripts/postinstall.mjs~/.cursor/skills/<muggle skill>~/.cursor/mcp.json~/.muggle-ai/electron-app/<version>

Network endpoints1

github.com

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/plugin/scripts/guard-run.mjsView file

1import { spawn, spawnSync } from 'child_process'; L2: import { existsSync } from 'fs';

High

Child Process

Package source references child process execution.

dist/plugin/scripts/guard-run.mjsView on unpkg · L1

32const bareCommandLine = buildWindowsCommandLine(input.options.command); L33: const commandLine = input.commandNeedsCmdShell ? `cmd.exe /d /s /c "${bareCommandLine}"` : bareCommandLine; L34: return {

High

Shell

Package source references shell execution.

dist/plugin/scripts/guard-run.mjsView on unpkg · L32

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L69: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/chunk-FK7XVMVA.jsView file

12Cross-file remote execution chain: dist/chunk-FK7XVMVA.js spawns dist/chunk-VQZLKLAY.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L584: if (inlineBytes <= opts.maxBodyBytes) { L585: return { body: inlineBody, comment: null }; L586: } ... L704: } L705: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L706: try { ... L821: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-FK7XVMVA.jsView on unpkg · L12

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

config/runtime-targets.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

config/runtime-targets.jsonView on unpkg

dist/chunk-VQZLKLAY.jsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/chunk-H5UDFKG3.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-VQZLKLAY.jsView on unpkg

dist/plugin/scripts/guardrails.mjsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/plugin/scripts/guardrails.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrails.mjsView on unpkg

plugin/scripts/guardrails.mjsView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/plugin/scripts/guardrails.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrails.mjsView on unpkg

dist/plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrail-record-comment-replies.shView on unpkg

dist/plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/pr-watch-arm.shView on unpkg

plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrail-record-comment-replies.shView on unpkg

plugin/scripts/pr-watch-arm.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.13.1 matchedPath = dist/plugin/scripts/pr-watch-arm.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.13.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/pr-watch-arm.shView on unpkg