registry / @nextsparkjs/ai-workflow / 0.1.0-beta.187

@nextsparkjs/ai-workflow@0.1.0-beta.187

AI workflow templates for NextSpark - Claude Code agents, commands, skills, and multi-editor support

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On installation, the package can update an existing consumer .claude workflow tree. This is a guarded but automatic AI-agent extension mutation.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation or update in a NextSpark project that already has .claude configured.

Impact

Existing agent instructions, commands, skills, templates, workflows, and schemas may be replaced without an explicit setup command.

Mechanism

Postinstall launches a local copier that overwrites selected .claude workflow content.

AI rationale

Automatic lifecycle mutation of a consumer AI-agent control surface remains a meaningful supply-chain risk, even though it is scoped to NextSpark projects. Static inspection found no exfiltration, remote execution, or self-dependent lifecycle chain.

Evidence

package.jsonscripts/postinstall.mjsscripts/setup.mjs.claude/agents/.claude/commands/.claude/skills/.claude/templates/.claude/workflows/.claude/_docs/.claude/config/*.schema.json

Decision evidence

public snapshot

@nextsparkjs/ai-workflow@0.1.0-beta.187

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code