registry / @nextsparkjs/ai-workflow / 0.1.0-beta.188

@nextsparkjs/ai-workflow@0.1.0-beta.188

AI workflow templates for NextSpark - Claude Code agents, commands, skills, and multi-editor support

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installing or updating the package can automatically replace files in an existing NextSpark .claude workflow directory. The install path performs no confirmed network or credential exfiltration.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall in a NextSpark project that already has .claude.

Impact

Existing agent commands, skills, templates, workflows, and schemas can change without a separate setup command.

Mechanism

Guarded lifecycle execution that copies and overwrites AI-agent workflow files.

AI rationale

The guarded postinstall modifies a broad AI-agent control surface automatically, so it warrants a warning. The source does not establish concrete malware behavior or a blocking install-hook abuse chain.

Evidence

package.jsonscripts/postinstall.mjsscripts/setup.mjs.claude/agents/**.claude/commands/**.claude/skills/**.claude/templates/**.claude/workflows/**.claude/_docs/**.claude/config/*.schema.json.claude/sessions

@nextsparkjs/ai-workflow@0.1.0-beta.188

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code