Loading npm security reports…

@mxalbert/context-mode@2.0.5: AI-agent control-surface risk | LPM Firewall

registry / @mxalbert/context-mode / 2.0.5

@mxalbert/context-mode@2.0.5

MCP plugin that saves 98% of your context window. Works with Claude Code, Gemini CLI, VS Code Copilot, OpenCode, and Codex CLI. Sandboxed code execution, FTS5 knowledge base, and intent-driven search.

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically mutates Claude Code’s user-level plugin control files. It can enable this plugin and redirect a missing registered cache path to the installed package.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation runs the postinstall hook; the settings changes are gated to global installs, but the symlink repair is not.

Impact

Claude Code may load and run this package through a user-level plugin registration without an explicit setup command.

Mechanism

Postinstall rewrites Claude plugin settings and creates cache-path symlinks.

Policy narrative

The package’s automatic postinstall hook edits Claude Code’s plugin registry and settings, forcing its plugin enabled unless a false value already exists. It also repairs missing registered plugin paths by creating symlinks to the installed package. These actions alter an external AI-agent control surface during installation rather than through an explicit user setup action, creating a path for the package to be loaded by Claude Code.

AI rationale

This is concrete automatic mutation of a foreign AI-agent control surface, including forced plugin enablement and registry-path redirection. The scope checks do not remove the unconsented postinstall behavior.

Evidence

package.jsonscripts/postinstall.mjsscripts/heal-installed-plugins.mjs~/.claude/settings.json~/.claude/plugins/installed_plugins.json~/.claude/plugins/cache/...

Source & flagged code

19 flagged

package.jsonView file

Lines 83-123json

83 "scripts": {

84 "build": "tsc && node -e \"if(process.platform!=='win32'){require('fs').chmodSync('build/cli.js',0o755)}\" && npm run bundle && npm run assert-bundle && npm run assert-asymmetric-drift",

85 "assert-bundle": "node scripts/assert-bundle.mjs server.bundle.mjs cli.bundle.mjs hooks/session-extract.bundle.mjs hooks/session-snapshot.bundle.mjs hooks/session-db.bundle.mjs hooks/security.bundle.mjs",

86 "assert-asymmetric-drift": "node scripts/assert-asymmetric-drift.mjs",

87 "bundle": "esbuild src/server.ts --bundle --platform=node --target=node18 --format=esm --outfile=server.bundle.mjs --external:better-sqlite3 --external:turndown --external:turndown-plugin-gfm --external:@mixmark-io/domino --minify && esbuild src/cli.ts --bundle --platform=node --target=node18 --format=esm --outfile=cli.bundle.mjs --external:better-sqlite3 --minify && esbuild src/session/extract.ts --bundle --platform=node --target=node18 --format=esm --outfile=hooks/session-extract.bundle.mjs --minify && esbuild src/session/snapshot.ts --bundle --platform=node --target=node18 --format=esm ...

88 "version-sync": "node scripts/version-sync.mjs",

89 "version": "node scripts/version-sync.mjs && git add package.json .claude-plugin/plugin.json .claude-plugin/marketplace.json .cursor-plugin/plugin.json .codex-plugin/plugin.json .openclaw-plugin/openclaw.plugin.json .openclaw-plugin/package.json openclaw.plugin.json .pi/extensions/context-mode/package.json

90 "prepublishOnly": "npm run build",

91 "dev": "npx tsx src/server.ts",

92 "setup": "npx tsx src/cli.ts setup",

93 "doctor": "npx tsx src/cli.ts doctor",

94 "typecheck": "tsc --noEmit",

95 "pretest": "npm run build",

96 "test": "vitest run",

97 "test:watch": "vitest",

98 "benchmark": "npx tsx tests/benchmark.ts",

99 "test:use-cases": "npx tsx tests/use-cases.ts",

100 "test:compare": "npx tsx tests/context-comparison.ts",

101 "test:ecosystem": "npx tsx tests/ecosystem-benchmark.ts",

102 "install:openclaw": "node -e \"if(process.platform==='win32'){console.error('OpenClaw install requires bash (Git Bash or WSL)');process.exit(1)}else{require('child_process').execSync('bash scripts/install-openclaw-plugin.sh',{stdio:'inherit'})}\"",

103 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L103

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L103

104 },

105 "dependencies": {

106 "@clack/prompts": "^1.0.1",

107 "@mixmark-io/domino": "^2.2.0",

108 "@modelcontextprotocol/sdk": "^1.26.0",

109 "better-sqlite3": "^12.6.2",

110 "picocolors": "^1.1.1",

111 "turndown": "^7.2.0",

112 "turndown-plugin-gfm": "^1.0.2",

113 "zod": "^3.25.0"

114 },

115 "devDependencies": {

116 "@types/better-sqlite3": "^7.6.13",

117 "@types/node": "^22.19.11",

118 "@types/turndown": "^5.0.5",

119 "esbuild": "^0.27.3",

120 "tsx": "^4.21.0",

121 "typescript": "^5.7.0",

122 "vitest": "^4.0.18"

123 },

Long lines were clipped for display.

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

bin/statusline.mjsView file

Lines 10-76javascript

10 * Claude sessions colliding on the same shell ppid).

11 *

12 * Discipline (Datadog / Stripe / Vercel pattern):

13 * - "context-mode" full brand label, never abbreviated

scripts/heal-better-sqlite3.mjsView file

Lines 1-30javascript

1/**

2 * Self-heal a missing better-sqlite3 native binding (#408).

3 *

4 * Single source of truth for the 3-layer heal used by both

5 * `scripts/postinstall.mjs` (install-time) and `hooks/ensure-deps.mjs`

6 * (runtime). Keeping one implementation avoids the duplicated logic the

7 * maintainer flagged on PR #410.

8 *

9 * Background:

10 * On Windows, `npm rebuild better-sqlite3` falls through to `node-gyp`

server.bundle.mjsView file

182L183: Use context-mode MCP tools (execute, execute_file, batch_execute, fetch_and_index, search) instead of run_command/view_file for data-heavy operations.`}}}});var eT={};je(eT,{Antigr... L184: `,"utf-8"),n.push(`Configured Antigravity CLI PreToolUse/PostToolUse hooks and best-effort Stop hook in ${r}`)),n}validateHooks(e){let{ok:n,where:r,preOk:o,postOk:s,stopOk:i}=mH([d... L185: ... L191: L192: Use context-mode MCP tools (ctx_execute, ctx_execute_file, ctx_batch_execute, ctx_fetch_and_index, ctx_search) instead of inline shell/HTTP calls for data-heavy operations.`}}});im... L193: `)}function Cg(t){return t.command.includes("context-mode hook kimi")}function qH(t,e){let n=(e.hooks?.[0]?.command??"").trim();return n?{event:t,matcher:e.matcher||void 0,command:... ... L195: Use c

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server.bundle.mjsView on unpkg · L182

2var XP=Object.create;var yl=Object.defineProperty;var YP=Object.getOwnPropertyDescriptor;var QP=Object.getOwnPropertyNames;var eR=Object.getPrototypeOf,tR=Object.prototype.hasOwnPr... L3: `:""},this._extScope=e,this._scope=new on.Scope({parent:e}),this._nodes=[new lf]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L4: || (${i} == "string" && ${o} && ${o} == +${o})`).assign(a,(0,Y._)`+${o}`);return;case"integer":r.elseIf((0,Y._)`${i} === "boolean" || ${o} === null L5: || (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,Y._)`+${o}`);return;case"boolean":r.elseIf((0,Y._)`${o} === "false" || ${o} === 0 || ${o} === null`).as... L6: || ${i} === "boolean" || ${o} === null`).assign(a,(0,Y._)`[${o}]`)}}}function XI

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

server.bundle.mjsView on unpkg · L2

scripts/postinstall.mjsView file

10L11: import { existsSync, mkdirSync, readFileSync, writeFileSync, symlinkSync, lstatSync, unlinkSync } from "node:fs"; L12: import { execSync } from "node:child_process"; ... L16: import { healBetterSqlite3Binding } from "./heal-better-sqlite3.mjs"; L17: import { healInstalledPlugins, healSettingsEnabledPlugins, healPluginJsonMcpServers, sweepStaleMcpJson } from "./heal-installed-plugins.mjs"; L18: ... L127: try { L128: const registryPath = resolve(homedir(), ".claude", "plugins", "installed_plugins.json"); L129: const pluginCacheRoot = resolve(homedir(), ".claude", "plugins", "cache"); L130: const result = healInstalledPlugins({ ... L154: try { L155: const settingsPath = resolve(homedir(), ".claude", "settings.json");

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

build/adapters/codex/index.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. changes.push(`removed ${prunedtrust.removed.length} stale codex hook trust entr${prunedtrust.removed.length === 1 ? "y" : "ies"}`); } } if (settingstext !== settingsraw) { const newline = settingstext.includes("\r\n") ? "\r\n" : "\n"; const text = settingstext.endswith("\n") ? settingstext : `${settingstext}${newline}`; mkdirsync(dirname(settingspath), { recursive: true }); writefilesync(settingspath, text, "utf-8"); if (enabledsettingschanged) changes.push("enabled codex hooks feature flag"); } return changes; } backupse

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

build/adapters/codex/index.jsView on unpkg

build/cli.jsView file

17Cross-file remote execution chain: build/cli.js spawns build/server.js; helper contains network access plus dynamic code execution. L17: import color from "picocolors"; L18: import { execFileSync, execSync, execFile as nodeExecFile } from "node:child_process"; L19: import { readFileSync, cpSync, accessSync, existsSync, readdirSync, rmSync, closeSync, openSync, chmodSync, lstatSync, realpathSync, statSync, constants } from "node:fs"; L20: import { request as httpsRequest } from "node:https"; L21: import { resolve, dirname, join, sep, basename, isAbsolute } from "node:path"; ... L38: import { detectWindowsVsYear } from "../scripts/heal-better-sqlite3.mjs"; L39: // Private 16-LOC copy of browserOpenArgv. Canonical version lives in src/server.ts; L40: // duplicated here so the cli bundle does

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/cli.jsView on unpkg · L17

cli.bundle.mjsView file

486Trigger-reachable chain: manifest.exports -> cli.bundle.mjs L486: L487: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let l of this.seen.entries()){let d=l[1];if(e===l[0]){i(l);continue}if(r.external){let m=r.ex... L488: `);if("message"in t&&typeof t.message=="string")return t.message;try{return JSON.stringify(t)}catch{return String(t)}}return String(t)}function OE(t){return t.description}function ... L489: ]))`;continue}else if(r[c]==="$"){o+=`($|(?=[\r ... L495: || (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,ne._)`+${o}`);return;case"boolean":r.elseIf((0,ne._)`${o} === "false" || ${o} === 0 || ${o} === null`).... L496: || ${i} === "boolean" || ${o} === null`).assign(a,(0,ne._)`[${o}]`)}}}function XU({gen:t,parentData

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.bundle.mjsView on unpkg · L486

486Trigger-reachable command-output exfiltration chain: manifest.exports -> cli.bundle.mjs L486: L487: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let l of this.seen.entries()){let d=l[1];if(e===l[0]){i(l);continue}if(r.external){let m=r.ex... L488: `);if("message"in t&&typeof t.message=="string")return t.message;try{return JSON.stringify(t)}catch{return String(t)}}return String(t)}function OE(t){return t.description}function ... L489: ]))`;continue}else if(r[c]==="$"){o+=`($|(?=[\r ... L495: || (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,ne._)`+${o}`);return;case"boolean":r.elseIf((0,ne._)`${o} === "false" || ${o} === 0 || ${o} === null`).... L496: || ${i} === "boolean" || ${o} === null`).assign(a,(0,ne._)`[${o}]`)}}}f

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.bundle.mjs

scripts/heal-better-sqlite3.mjs#virtual:normalized:round1View file

149// Re-check after install. If npm wrote the package AND its L150: // postinstall produced the binding, we"re done. Otherwise fall\n // through into the binding-missing flow below.\n if (fsExistsSync(bindingPath)) {\n return { hea... L151: // own install script. Avoids the rebuild → node-gyp fall-through.

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/heal-better-sqlite3.mjs#virtual:normalized:round1View on unpkg · L149

bin/statusline.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/statusline.mjs#virtual:normalized:round1View on unpkg

build/session/extract.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mxalbert/context-mode@2.0.4 matchedIdentity = npm:QG14YWxiZXJ0L2NvbnRleHQtbW9kZQ:2.0.4 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/session/extract.jsView on unpkg

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/statusline.mjsView file

30import { fileURLToPath, pathToFileURL } from "node:url"; L31: import { execFileSync } from "node:child_process"; L32: import {

High

Child Process

Package source references child process execution.

bin/statusline.mjsView on unpkg · L30

56try { L57: _analytics = await import(ANALYTICS_URL); L58: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/statusline.mjsView on unpkg · L56

scripts/heal-better-sqlite3.mjsView file

10* On Windows, `npm rebuild better-sqlite3` falls through to `node-gyp` L11: * when prebuild-install is not on cmd.exe PATH, then dies for users L12: * without Visual Studio C++ tooling. We bypass that by spawning

High

Shell

Package source references shell execution.

scripts/heal-better-sqlite3.mjsView on unpkg · L10

server.bundle.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server.bundle.mjsView on unpkg · L182

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

server.bundle.mjsView on unpkg · L2

scripts/postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

build/adapters/codex/index.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

build/adapters/codex/index.jsView on unpkg

build/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/cli.jsView on unpkg · L17

cli.bundle.mjsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.bundle.mjsView on unpkg · L486

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.bundle.mjs

scripts/heal-better-sqlite3.mjs#virtual:normalized:round1View file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/heal-better-sqlite3.mjs#virtual:normalized:round1View on unpkg · L149

bin/statusline.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/statusline.mjs#virtual:normalized:round1View on unpkg

build/session/extract.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/session/extract.jsView on unpkg

Source & flagged code

19 flagged

package.jsonView file

Lines 83-123json

83 "scripts": {

84 "build": "tsc && node -e \"if(process.platform!=='win32'){require('fs').chmodSync('build/cli.js',0o755)}\" && npm run bundle && npm run assert-bundle && npm run assert-asymmetric-drift",

86 "assert-asymmetric-drift": "node scripts/assert-asymmetric-drift.mjs",

88 "version-sync": "node scripts/version-sync.mjs",

90 "prepublishOnly": "npm run build",

91 "dev": "npx tsx src/server.ts",

92 "setup": "npx tsx src/cli.ts setup",

93 "doctor": "npx tsx src/cli.ts doctor",

94 "typecheck": "tsc --noEmit",

95 "pretest": "npm run build",

96 "test": "vitest run",

97 "test:watch": "vitest",

98 "benchmark": "npx tsx tests/benchmark.ts",

99 "test:use-cases": "npx tsx tests/use-cases.ts",

100 "test:compare": "npx tsx tests/context-comparison.ts",

101 "test:ecosystem": "npx tsx tests/ecosystem-benchmark.ts",

103 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L103

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L103

104 },

105 "dependencies": {

106 "@clack/prompts": "^1.0.1",

107 "@mixmark-io/domino": "^2.2.0",

108 "@modelcontextprotocol/sdk": "^1.26.0",

109 "better-sqlite3": "^12.6.2",

110 "picocolors": "^1.1.1",

111 "turndown": "^7.2.0",

112 "turndown-plugin-gfm": "^1.0.2",

113 "zod": "^3.25.0"

114 },

115 "devDependencies": {

116 "@types/better-sqlite3": "^7.6.13",

117 "@types/node": "^22.19.11",

118 "@types/turndown": "^5.0.5",

119 "esbuild": "^0.27.3",

120 "tsx": "^4.21.0",

121 "typescript": "^5.7.0",

122 "vitest": "^4.0.18"

123 },

Long lines were clipped for display.

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

bin/statusline.mjsView file

Lines 10-76javascript

10 * Claude sessions colliding on the same shell ppid).

11 *

12 * Discipline (Datadog / Stripe / Vercel pattern):

13 * - "context-mode" full brand label, never abbreviated

scripts/heal-better-sqlite3.mjsView file

Lines 1-30javascript

1/**

2 * Self-heal a missing better-sqlite3 native binding (#408).

3 *

4 * Single source of truth for the 3-layer heal used by both

5 * `scripts/postinstall.mjs` (install-time) and `hooks/ensure-deps.mjs`

6 * (runtime). Keeping one implementation avoids the duplicated logic the

7 * maintainer flagged on PR #410.

8 *

9 * Background:

10 * On Windows, `npm rebuild better-sqlite3` falls through to `node-gyp`

server.bundle.mjsView file

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

server.bundle.mjsView on unpkg · L182

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

server.bundle.mjsView on unpkg · L2

scripts/postinstall.mjsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.mjsView on unpkg · L10

build/adapters/codex/index.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

build/adapters/codex/index.jsView on unpkg

build/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/cli.jsView on unpkg · L17

cli.bundle.mjsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.bundle.mjsView on unpkg · L486

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.bundle.mjs

scripts/heal-better-sqlite3.mjs#virtual:normalized:round1View file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/heal-better-sqlite3.mjs#virtual:normalized:round1View on unpkg · L149

bin/statusline.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/statusline.mjs#virtual:normalized:round1View on unpkg

build/session/extract.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/session/extract.jsView on unpkg

@mxalbert/context-mode@2.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code