Loading npm security reports…

@muggleai/works@5.19.0: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.19.0

@muggleai/works@5.19.0

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm install runs a postinstall script that writes the user-level Cursor skill directory and Cursor MCP configuration without asking. It plants muggle skills and registers an MCP server command that Cursor will launch.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall of @muggleai/works

Impact

After a normal install, Cursor loads package-authored skills and starts the package MCP server for that user account, changing a foreign agent control surface.

Mechanism

syncCursorSkills copies matching skill trees into ~/.cursor/skills after deleting the destination, then removes obsolete names from the prior manifest. upsertCursorMcpConfig merges mcpServers.muggle into ~/.cursor/mcp.json with command muggle and args serve.

Policy narrative

Installing @muggleai/works runs scripts/postinstall.mjs automatically. The script copies its skill directories into ~/.cursor/skills, replacing same-named folders and deleting skills it previously installed. It then writes ~/.cursor/mcp.json so Cursor starts muggle serve. No install-time prompt gates those writes. A later Claude plugin cache refresh only proceeds if that plugin was already registered.

AI rationale

The postinstall hook unconditionally mutates Cursor user skills and the user MCP server list, which is a foreign agent control surface, without consent. That install-time control-surface write is concrete attack behavior even though the Electron download itself is package-aligned.

Evidence

package.jsonscripts/postinstall.mjs~/.cursor/skills~/.cursor/mcp.json~/.claude/plugins/installed_plugins.json

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ZA5KHVX5.jsView file

10import winston from 'winston'; L11: import { exec, spawn } from 'child_process'; L12: import axios, { AxiosError } from 'axios';

High

Child Process

Package source references child process execution.

dist/chunk-ZA5KHVX5.jsView on unpkg · L10

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L70: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

849platform() === "win32" L850: ? `powershell -command "Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force"` L851: : `unzip -o "${zipPath}" -d "${destDir}"`;

High

Shell

Package source references shell execution.

scripts/postinstall.mjsView on unpkg · L849

dist/chunk-H2KMRAQZ.jsView file

12Cross-file remote execution chain: dist/chunk-H2KMRAQZ.js spawns dist/chunk-ZA5KHVX5.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { createInterface } from 'readline/promises'; L16: import { execFile, execFileSync } from 'child_process'; L17: import { pipeline } from 'stream/promises'; ... L585: if (inlineBytes <= opts.maxBodyBytes) { L586: return { body: inlineBody, comment: null }; L587: } ... L705: } L706: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L707: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-H2KMRAQZ.jsView on unpkg · L12

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

scripts/postinstall.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/postinstall.mjs#virtual:normalized:round1View on unpkg

dist/plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.14.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrail-record-comment-replies.shView on unpkg

plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.14.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrail-record-comment-replies.shView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 21-61json

21 "clean": "rimraf dist",

22 "build": "tsup && node scripts/strip-telemetry-comments.mjs && node scripts/write-release-manifest.mjs && node scripts/sync-versions.mjs && node scripts/build-plugin.mjs",

23 "build:plugin": "node scripts/build-plugin.mjs",

24 "sync:versions": "node scripts/sync-versions.mjs",

25 "build:release": "npm run build",

26 "verify:plugin": "node scripts/verify-plugin-marketplace.mjs",

27 "verify:contracts": "node scripts/verify-compatibility-contracts.mjs",

28 "verify:skill-deps": "node scripts/check-skill-deps.mjs",

29 "verify:signatures": "node scripts/check-post-signatures.mjs",

30 "smoke:cli": "node scripts/smoke-cli.mjs",

31 "verify:electron-release-checksums": "node scripts/verify-electron-release-checksums.mjs",

32 "verify:upgrade-experience": "node scripts/verify-upgrade-experience.mjs",

33 "link:maintainer-skills": "node scripts/link-maintainer-skills.mjs",

34 "build:workspace": "turbo run build",

35 "typecheck:workspace": "turbo run typecheck",

36 "lint:workspace": "turbo run lint",

37 "test:workspace": "turbo run test",

38 "dev:workspace": "turbo run dev",

39 "bootstrap": "npm install && npm run build",

40 "bootstrap:workspace": "pnpm install && pnpm run build:workspace",

41 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "start": "node dist/index.js",

43 "dev": "tsx watch src/index.ts",

44 "lint": "eslint . --fix",

45 "lint:check": "eslint .",

46 "typecheck": "tsc --noEmit",

47 "test": "vitest run",

48 "test:watch": "vitest",

49 "test:gates:behavioral": "tsx internal/skill-gate-eval/src/run.ts",

50 "test:agents:behavioral": "tsx internal/agent-gate-eval/src/run.ts",

51 "eval:studio-gen": "tsx internal/studio-gen-eval/src/run.ts",

52 "typecheck:browser-bench": "tsc --noEmit -p internal/browser-bench/tsconfig.json"

53 },

54 "muggleConfig": {

55 "electronAppVersion": "1.10.6",

56 "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",

57 "runtimeTargetDefault": "production",

58 "checksumsByStream": {

59 "production": {

60 "win32-x64": "c20acdc2fd7a05039c62f9e5b079e3068d1b3a23a1b3b37b75e2a650b5401de6",

61 "linux-x64": "5167eaed4b82fdf57b09c0525437f9c1e0942bc05418a4f993d3b7fc9c807d1f",

dist/chunk-ZA5KHVX5.jsView file

Lines 1-30javascript

1import * as fs4 from 'fs';

2import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';

3import * as path13 from 'path';

scripts/postinstall.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/* global AbortController */

3/**

4 * Postinstall script for @muggleai/works.

5 * Downloads the Electron app binary for local testing.

6 * Output is written to both console and ~/.muggle-ai/postinstall.log

7 */

8

9import { createHash } from "crypto";

10

dist/chunk-H2KMRAQZ.jsView file

Lines 1-32javascript

1import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getActiveRuntimeTarget, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, reconcileProjectPreferences, getDataDir, PREFERENCES_FILE_NAME, isFirstRun, writePreferences, DEFAULT_PREFERENCES, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, getElectronAppSignedFromVersion, getReleaseSignerIdentityUri, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, assert ...

2import { Server } from '@modelcontextprotocol/sdk/server/index.js';

3import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';

4import { v4 } from

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 4376 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

scripts/postinstall.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/postinstall.mjs#virtual:normalized:round1View on unpkg

dist/plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.14.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin/scripts/guardrail-record-comment-replies.shView on unpkg

plugin/scripts/guardrail-record-comment-replies.shView file

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.14.0 matchedPath = dist/plugin/scripts/guardrail-record-comment-replies.sh matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.14.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

plugin/scripts/guardrail-record-comment-replies.shView on unpkg