registry / @nextsparkjs/ai-workflow / 0.1.0-beta.190

@nextsparkjs/ai-workflow@0.1.0-beta.190

AI workflow templates for NextSpark - Claude Code agents, commands, skills, and multi-editor support

AI Security Review

scanned 20d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. After npm install, a postinstall hook can copy this package's Claude Code agents, commands, and skills into an existing project .claude folder. The copy is limited to NextSpark apps that already set up that folder and does not send data off-box.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm or pnpm install or update of @nextsparkjs/ai-workflow in a NextSpark project that already contains .claude.

Impact

Claude Code project agents, slash commands, and skills are replaced with the templates shipped in this package.

Mechanism

postinstall execSync of setup.mjs overwriting first-party Claude workflow files

AI rationale

This is first-party NextSpark AI workflow setup that auto-syncs the package's own Claude templates on install, gated to existing NextSpark projects with .claude already present. Scanner malware-fingerprint and secret hits are not backed by network exfiltration, real secrets, or a hijack beyond that documented extension sync.

Evidence

package.jsonscripts/postinstall.mjsscripts/setup.mjs.claude/agents.claude/commands.claude/skills.claude/templates.claude/workflows.claude/_docs.claude/config

@nextsparkjs/ai-workflow@0.1.0-beta.190

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code