registry / @nextsparkjs/ai-workflow / 0.1.0-beta.189

@nextsparkjs/ai-workflow@0.1.0-beta.189

AI workflow templates for NextSpark - Claude Code agents, commands, skills, and multi-editor support

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An automatic postinstall can update package-managed files in an existing consumer .claude directory. The behavior is guarded for NextSpark projects but changes an AI-agent control surface without a per-update command.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing or updating the package in a qualifying NextSpark project with .claude already present.

Impact

Package updates can replace managed agent instructions, commands, skills, templates, workflows, and schemas.

Mechanism

Guarded postinstall copy of package-supplied AI workflow files.

AI rationale

The package has a real automatic AI-agent extension update surface, so it warrants a warning. Source inspection found no concrete malicious payload, exfiltration, network activity, or broad unguarded mutation.

Evidence

package.jsonscripts/postinstall.mjsscripts/setup.mjsconsumer package.json.claude/agents/**.claude/commands/**.claude/skills/**.claude/templates/**.claude/workflows/**.claude/_docs/**.claude/config/*.schema.json

@nextsparkjs/ai-workflow@0.1.0-beta.189

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code