Loading npm security reports…

@nemzilla/hydrate@3.0.0: AI-agent control-surface risk | LPM Firewall

registry / @nemzilla/hydrate / 3.0.0

@nemzilla/hydrate@3.0.0

Deterministic event-sourced context harness for AI-assisted engineering (HydrateZ).

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently creates Claude Code command definitions in the consuming project. Those commands direct an AI agent to run commands and make project-state changes.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation of the package as a dependency.

Impact

It creates an unconsented AI-agent control surface in the consumer project that can cause command execution and project-file mutation when invoked.

Mechanism

Postinstall writes foreign Claude Code command files.

Policy narrative

During npm postinstall, the package uses INIT_CWD to select the consuming project rather than its own directory. It creates a .claude/commands directory and installs several Claude Code command definitions without an explicit setup command. The installed hydrate command instructs an AI agent to use Bash, run package commands, and automatically archive work by changing .hydrate/CURRENT_UOW.md. This is an unconsented install-time mutation of a foreign AI-agent control surface.

AI rationale

The automatic postinstall hook writes AI-agent command files into the consumer project and supplies commands that direct later tool use and file mutation. This meets the install-hook abuse policy even though no network exfiltration was found.

Evidence

package.jsonbin/postinstall.jssrc/init.jstemplates/.claude/commands/hydrate.md.template.claude/commands/hydrate.md.claude/commands/hydrate-checkup.md.claude/commands/hydrate-ingest.md.hydrate/CURRENT_UOW.md

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"scripts": { "postinstall": "node bin/postinstall.js", "test": "node --test --experimental-test-coverage test/*.test.js"

High

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L11

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

14Install-time code directly mutates a foreign AI-agent control surface: L20: if (created.length) { L21: console.log('💧 @nemzilla/hydrate: provisioned Claude Code slash commands in .claude/commands/'); L22: created.forEach(({ label }) => console.log(` ✔ ${label}`)); Write operation from src/init.js: L14: L15: // Zero-touch Claude Code slash commands scaffolded into .claude/commands/ — L16: // each wraps a `hydrate` CLI verb so a session can boot straight into the ... L19: const CLAUDE_COMMANDS = [ L20: { name: 'hydrate.md', label: 'Created .claude/commands/hydrate.md (/hydrate slash command)' }, L21: { name: 'hydrate-checkup.md', label: 'Created .claude/commands/hydrate-checkup.md (/hydrate-checkup slash command)' }, L22: { name: 'hydrate-ingest.md', label: 'Created .claude/commands/hydra

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.jsView on unpkg · L14

12const targetCwd = process.env.INIT_CWD || process.cwd(); const pkgRoot = path.join(__dirname, '..'); // Skip when this fires for hydrate's own local `npm install` (dev on the // hydrate repo itself) rather than consumption as a host project's // dependency — INIT_CWD equals this package's own root in that case. if (path.resolve(targetCwd) !== path.resolve(pkgRoot)) { const created = scaffoldClaudeCommands(targetCwd); if (created.length) { console.log('💧 @nemzilla/hydrate: provisioned Claude Code slash commands in .claude/commands/');

High

Suspicious Lifecycle Evidence

Postinstall targets the consuming project's directory and provisions Claude Code slash commands.

bin/postinstall.jsView on unpkg · L12

src/init.jsView file

48const claudeCommandsDir = path.join(cwd, '.claude', 'commands'); if (!fs.existsSync(claudeCommandsDir)) { fs.mkdirSync(claudeCommandsDir, { recursive: true }); } for (const { name, label } of CLAUDE_COMMANDS) { const filePath = path.join(claudeCommandsDir, name); if (!fs.existsSync(filePath)) { fs.writeFileSync(filePath, renderTemplate(path.join('.claude', 'commands', name), { PROJECT_NAME: projectName }), 'utf8'); created.push({ path: filePath, label });

High

Ai Review Evidence

The installer creates multiple files under the foreign project's .claude/commands directory.

src/init.jsView on unpkg · L48

templates/.claude/commands/hydrate.md.templateView file

5Run `hydrate checkup` in the project root using the Bash tool. 1. If the reported state is `unarchived-done`, immediately run `hydrate complete` to archive the finished UOW and reset `.hydrate/CURRENT_UOW.md`. 2. Run `hydrate context --clip` to compile the latest Architect Context payload and copy it to the OS clipboard.

High

Ai Review Evidence

An installed command instructs the AI agent to use Bash and automatically archive project work.

templates/.claude/commands/hydrate.md.templateView on unpkg · L5

Source & flagged code

7 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "@nemzilla/hydrate",

3 "version": "3.0.0",

4 "description": "Deterministic event-sourced context harness for AI-assisted engineering (HydrateZ).",

5 "main": "index.js",

6 "type": "commonjs",

7 "bin": {

8 "hydrate": "bin/cli.js",

9 "hz": "bin/cli.js"

10 },

11 "scripts": {

12 "postinstall": "node bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 "test": "node --test --experimental-test-coverage test/*.test.js"

High

Suspicious Lifecycle Evidence

The package runs a postinstall script automatically.

package.jsonView on unpkg · L11

14 },

15 "repository": {

16 "type": "git",

17 "url": "git+https://github.com/rnemzek/hydrate.git"

18 },

19 "homepage": "https://github.com/rnemzek/hydrate#readme",

20 "bugs": {

21 "url": "https://github.com/rnemzek/hydrate/issues"

22 },

23 "keywords": [

24 "hydratez",

25 "nemzilla",

26 "ai",

27 "context-harness",

28 "developer-tools",

29 "claude",

30 "claude-code",

31 "gemini",

32 "llm-context",

bin/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2

3const path = require('path');

4const { scaffoldClaudeCommands } = require('../src/init');

5

6// npm sets INIT_CWD to the directory `npm install` was actually invoked

src/init.jsView file

Lines 28-68javascript

28 { name: 'hydrate-digest.md', label: 'Created .claude/commands/hydrate-digest.md (/hydrate-digest slash command)' }

29];

30

31// docs/ artifacts scaffolded alongside .hydrate/ — the architecture map

32// (Claude-Code-owned, regenerated by /hydrate-arch-sync) and its narrative

33// decision journal (append-only, fed by "Generate Architecture Journal Digest").

34const DOCS_ARTIFACTS

templates/.claude/commands/hydrate.md.templateView file

Lines 1-13text

1---

2description: Unified Hydrate master command — checkup, auto-archive, and clipboard sync in one shot.

3---

4

5Run `hydrate checkup` in the project root using the Bash tool.

6

71. If the reported state is `unarchived-done`, immediately run `hydrate complete`

8 to archive the finished UOW and reset `.hydrate/CURRENT_UOW.md`.

92. Run `hydrate context --clip` to compile the latest Architect Context payload

10 and copy it to the OS clipboard.

High

Ai Review Evidence

An installed command instructs the AI agent to use Bash and automatically archive project work.