Loading npm security reports…

@ninjamin/astra-os@0.2.4: AI-agent control-surface risk | LPM Firewall

registry / @ninjamin/astra-os / 0.2.4

@ninjamin/astra-os@0.2.4

Astra OS — a portable agent harness that drives one coding agent (Pi SDK or claude, droid, opencode, hermes, codex) through five front-loaded software-factory gates: product intent, architecture with adversarial audit, program design contracts, DAG planni

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall installer that modifies detected AI-agent installations. It adds package-provided skills, commands, and an MCP server to user-level agent control surfaces.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation when a supported agent CLI is present

Impact

Future agent sessions can load package-controlled prompts and start the package MCP server with the user's permissions.

Mechanism

Automatic user-level AI-agent extension and MCP registration

Policy narrative

A normal npm install invokes the postinstall hook. The hook detects installed Claude, Codex, or Factory tooling, copies package-controlled skills and commands into their user-level directories, and registers an Astra MCP server. This changes separate AI-agent control surfaces without an explicit setup command or interactive consent, so subsequent agent sessions may execute package-controlled functionality under the user's permissions.

Rationale

The package performs unconsented postinstall mutation of foreign, user-level AI-agent control surfaces. This is concrete install-hook abuse even though no external exfiltration endpoint was confirmed.

Evidence

package.jsonbin/astra.mjs~/.claude/skills~/.claude/commands~/.claude.json~/.codex/skills~/.codex/prompts~/.codex/config.toml~/.factory/skills~/.factory/commands~/.factory/mcp.json

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/astra.mjs install --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/astra.mjs install --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/astra.mjs#virtual:normalized:round1View file

461throw exit( L462: `clearing a gate is the human"s decision — surface this command instead of running it:\n astra approve ${gateId}`,\n 4,\n );\n }\n const { ok } = await checkGate(run.r... L463: process.exit(err.exitCode ?? 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/astra.mjs#virtual:normalized:round1View on unpkg · L461

bin/astra.mjsView file

51]); L52: // Claude Code reads slash commands from ~/.claude/commands; Codex reads them from ~/.codex/prompts. L53: const HOSTS = [ L54: { id: "claude", cli: "claude", skills: [".claude", "skills"], commands: [".claude", "commands"] }, L55: { id: "codex", cli: "codex", skills: [".codex", "skills"], commands: [".codex", "prompts"] }, L56: { id: "droid", cli: "droid", skills: [".factory", "skills"], commands: [".factory", "commands"] }, ... L106: const commandDir = join(homedir(), ...host.commands); L107: await mkdir(skillDir, { recursive: true }); L108: await mkdir(commandDir, { recursive: true }); L109: for (const name of SKILLS) { L110: await cp(join(PKG_ROOT, "skills", name), join(skillDir, name), { recursive: true, force: true }); L111: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/astra.mjsView on unpkg · L51

visualizer/server.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ninjamin/astra-os@0.2.1 matchedIdentity = npm:QG5pbmphbWluL2FzdHJhLW9z:0.2.1 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

visualizer/server.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 8-48json

8 "url": "https://github.com/justjammin/ASTRA_OS"

9 },

10 "homepage": "https://github.com/justjammin/ASTRA_OS#readme",

11 "bugs": {

12 "url": "https://github.com/justjammin/ASTRA_OS/issues"

13 },

14 "bin": {

15 "astra": "bin/astra.mjs",

16 "astra-mcp": "lib/mcp-server.mjs"

17 },

18 "publishConfig": {

19 "access": "public"

20 },

21 "scripts": {

22 "test": "node --test test/*.test.mjs",

23 "viz": "node visualizer/server.mjs",

24 "mcp": "node lib/mcp-server.mjs",

25 "site:dev": "npx wrangler@4 dev --config site.wrangler.jsonc",

26 "site:deploy": "npx wrangler@4 deploy --config site.wrangler.jsonc",

27 "release:pack": "npm pack",

28 "postinstall": "node bin/astra.mjs install --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L28

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L28

29 "prepublishOnly": "npm test"

30 },

31 "files": [

32 "bin/",

33 "lib/",

34 "visualizer/",

35 "skills/",

36 "commands/",

37 "site/",

38 "docs/harnesses/",

39 "agents/",

40 "assets/astra-os.svg",

41 ".claude-plugin/",

42 ".codex-plugin/",

43 ".factory-plugin/",

44 ".codex/",

45 "site.wrangler.jsonc",

46 "plugin.source.json",

47 "README.md",

48 "LICENSE",

bin/astra.mjs#virtual:normalized:round1View file

461throw exit( L462: `clearing a gate is the human"s decision — surface this command instead of running it:\n astra approve ${gateId}`,\n 4,\n );\n }\n const { ok } = await checkGate(run.r... L463: process.exit(err.exitCode ?? 1);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/astra.mjs#virtual:normalized:round1View on unpkg · L461

bin/astra.mjsView file

Lines 31-71javascript

31} from "../lib/ledger.mjs";

32import { REL, runRoot } from "../lib/paths.mjs";

33import { runDesignGate, runExecution } from "../lib/pipeline.mjs";

34import { MAP_DIR, loadMap, hydrate, scan } from "../lib/rolemap.mjs";

35import

visualizer/server.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ninjamin/astra-os@0.2.1 matchedIdentity = npm:QG5pbmphbWluL2FzdHJhLW9z:0.2.1 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

visualizer/server.mjsView on unpkg