Loading npm security reports…

@muggleai/works@5.9.0: AI-agent control-surface risk | LPM Firewall

registry / @muggleai/works / 5.9.0

@muggleai/works@5.9.0

Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.

AI Security Review

scanned 6d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. npm postinstall silently modifies Cursor’s user-wide AI-agent configuration and skill directories. It also installs a downloaded executable under the user home directory.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm install of @muggleai/works

Impact

Causes Cursor to launch the package MCP server and expose bundled agent skills without an explicit setup command.

Mechanism

install-time Cursor MCP/skill injection and Electron binary download

Policy narrative

Installing the package automatically runs its postinstall script. That script copies bundled skills into ~/.cursor/skills and upserts a `muggle` MCP server in ~/.cursor/mcp.json, so a foreign, user-wide AI-agent control surface is modified without an explicit user setup action. It additionally downloads, verifies, extracts, and stores an Electron executable under ~/.muggle-ai.

Rationale

This is a concrete unconsented postinstall mutation of a foreign AI-agent control surface, which meets the blocking policy. Checksums mitigate the binary-download risk but do not remove the control-surface injection.

Evidence

package.jsonscripts/postinstall.mjsplugin/README.mdplugin/hooks/hooks.jsonplugin/skills~/.cursor/skills~/.cursor/mcp.json~/.muggle-ai/electron-app

Network endpoints1

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-LVUJ4E62.jsView file

10import { fileURLToPath } from 'url'; L11: import { exec, spawn } from 'child_process'; L12: import axios, { AxiosError } from 'axios';

High

Child Process

Package source references child process execution.

dist/chunk-LVUJ4E62.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.10.0 matchedPath = dist/chunk-OCLMXAVJ.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-LVUJ4E62.jsView on unpkg

dist/chunk-5PYK7DWB.jsView file

1761execFile( L1762: "powershell", L1763: ["-command", `Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force`],

High

Shell

Package source references shell execution.

dist/chunk-5PYK7DWB.jsView on unpkg · L1761

12Cross-file remote execution chain: dist/chunk-5PYK7DWB.js spawns dist/chunk-LVUJ4E62.js; helper contains network access plus dynamic code execution. L12: import { Command } from 'commander'; L13: import axios from 'axios'; L14: import { platform, homedir, arch } from 'os'; L15: import { execFile } from 'child_process'; L16: import { pipeline } from 'stream/promises'; ... L582: if (inlineBytes <= opts.maxBodyBytes) { L583: return { body: inlineBody, comment: null }; L584: } ... L702: } L703: async function resolveOne(gsUrl, baseUrl, headers, stderrWrite) { L704: try { ... L807: for await (const chunk of stream) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-5PYK7DWB.jsView on unpkg · L12

•matchType = token_shingles matchedPackage = @muggleai/works@5.10.0 matchedPath = dist/chunk-7NC2DJTK.js matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.10.0 similarity = 0.750 shingleOverlap = 36 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-5PYK7DWB.js

scripts/postinstall.mjsView file

11import { L12: cpSync, L13: readFileSync, L14: appendFileSync, L15: createReadStream, ... L17: existsSync, L18: mkdirSync, L19: readdirSync, L20: rmSync, L21: writeFileSync, L22: } from "fs"; ... L64: const logDir = join(homedir(), ".muggle-ai");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L11

•matchType = normalized_sha256 matchedPackage = @muggleai/works@5.10.0 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QG11Z2dsZWFpL3dvcmtz:5.10.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 2326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 17-57json

17 "scripts": {

18 "clean": "rimraf dist",

19 "build": "tsup && node scripts/strip-telemetry-comments.mjs && node scripts/write-release-manifest.mjs && node scripts/sync-versions.mjs && node scripts/build-plugin.mjs",

20 "build:plugin": "node scripts/build-plugin.mjs",

21 "sync:versions": "node scripts/sync-versions.mjs",

22 "build:release": "npm run build",

23 "verify:plugin": "node scripts/verify-plugin-marketplace.mjs",

24 "verify:contracts": "node scripts/verify-compatibility-contracts.mjs",

25 "verify:skill-deps": "node scripts/check-skill-deps.mjs",

26 "smoke:cli": "node scripts/smoke-cli.mjs",

27 "verify:electron-release-checksums": "node scripts/verify-electron-release-checksums.mjs",

28 "verify:upgrade-experience": "node scripts/verify-upgrade-experience.mjs",

29 "link:maintainer-skills": "node scripts/link-maintainer-skills.mjs",

30 "build:workspace": "turbo run build",

31 "typecheck:workspace": "turbo run typecheck",

32 "lint:workspace": "turbo run lint",

33 "test:workspace": "turbo run test",

34 "dev:workspace": "turbo run dev",

35 "bootstrap": "npm install && npm run build",

36 "bootstrap:workspace": "pnpm install && pnpm run build:workspace",

37 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "start": "node dist/index.js",

39 "dev": "tsx watch src/index.ts",

40 "lint": "eslint . --fix",

41 "lint:check": "eslint .",

42 "typecheck": "tsc --noEmit",

43 "test": "vitest run",

44 "test:watch": "vitest",

45 "test:gates:behavioral": "tsx internal/skill-gate-eval/src/run.ts",

46 "test:agents:behavioral": "tsx internal/agent-gate-eval/src/run.ts",

47 "eval:studio-gen": "tsx internal/studio-gen-eval/src/run.ts"

48 },

49 "muggleConfig": {

50 "electronAppVersion": "1.6.12",

51 "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",

52 "runtimeTargetDefault": "production",

53 "checksums": {

54 "darwin-arm64": "d313b881b6f448b968c838a3b9bea4d8f226c60b703c377514d37f33d0dacd66",

55 "darwin-x64": "31f316bdcc97dbc764a9656fc3003a2640c613d6ce1f8ba1a73564987235f2f1",

56 "linux-x64": "1d06dfbf66ea97f55abfb6e3cd8a3edbea2c7c6bf75acbbd607039e7c6dae69b",

57 "win32-x64": "ff1150431afad2717e30d419d4ba15df79d20e10ae48a6293f71a723c7b3159a"

dist/chunk-LVUJ4E62.jsView file

Lines 1-30javascript

1import * as crypto from 'crypto';

2import { randomUUID } from 'crypto';

3import * as fs5 from 'fs';

dist/chunk-5PYK7DWB.jsView file

Lines 1-32javascript

1import { __export, getLogger, getConfig, createChildLogger, buildElectronAppReleaseAssetUrl, getAuthService, hasApiKey, getElectronAppVersion, getElectronAppDir, getPlatformKey, isFirstRun, writePreferences, DEFAULT_PREFERENCES, getDataDir, PREFERENCES_FILE_NAME, isElectronAppInstalled, getElectronAppChecksums, getChecksumForPlatform, verifyFileChecksum, calculateFileChecksum, initTelemetry, Surface, ServiceName, track, EventName, getQaTools, getLocalQaTools, performLogout, performLogin, toolRequiresAuth, getCallerCredentials, hasShownDisclosure, getDisclosureCopy, markDisclosureShown, getBund ...

2import { Server } from '@modelcontextprotocol/sdk/server/index.js';

3import { ListToolsRequestSchema, CallToolRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';

4import { v4 } from

scripts/postinstall.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/* global AbortController */

3/**

4 * Postinstall script for @muggleai/works.

5 * Downloads the Electron app binary for local testing.

6 * Output is written to both console and ~/.muggle-ai/postinstall.log

7 */

8

9import { createHash } from "crypto";

10

dist/plugin/scripts/reconcile-stale-watchers.shView file

•path = dist/plugin/scripts/reconcile-stale-watchers.sh kind = build_helper sizeBytes = 2326 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/plugin/scripts/reconcile-stale-watchers.shView on unpkg