registry / @opscanvas/opscanvas / 0.1.0

@opscanvas/opscanvas@0.1.0

Findings evaluation, planning, and verification engine for the practitioner's own agent harness.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package fetches an opaque native binary and automatically runs its setup action. That action is described as registering with whichever supported agent harnesses exist and starting a background process.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm postinstall

Impact

Unconsented installation can alter broad local AI-agent control surfaces and establish persistence through an uninspected binary.

Mechanism

Remote binary download followed by automatic agent-harness setup and background-process registration

Policy narrative

On npm installation, postinstall invokes the launcher. It downloads a platform-specific binary from packages.opscanvas.io, writes it as bin/opscanvas, and executes it with setup. The package states that setup registers with whichever supported agent harnesses are present and starts a background process, making this an automatic, broad agent-control and persistence action performed by opaque native code.

AI rationale

This is an unconsented postinstall path that downloads and executes opaque code to register across available agent harnesses and start a background process. Checksum verification limits replacement in transit but does not make the package-authored binary or its broad automatic setup safe.

Evidence

package.jsonpostinstall.mjslib/launcher.jsREADME.mdbin/opscanvas

Network endpoints1

packages.opscanvas.io

@opscanvas/opscanvas@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code