Loading npm security reports…

@pippit-dev/cli@1.0.21: AI-agent control-surface risk | LPM Firewall

registry / @pippit-dev/cli / 1.0.21

@pippit-dev/cli@1.0.21

Pippit CLI

AI Security Review

scanned 29d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies a global AI-agent skill surface. It registers all bundled skills non-interactively and removes legacy global skill directories.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation, via postinstall.

Impact

Package-authored instructions become available to compatible agents without an explicit skill-install action; those instructions direct host tool and browser use.

Mechanism

Global non-interactive AI-agent skill registration through npx.

Policy narrative

On npm installation, postinstall downloads a native binary, then automatically invokes npx to add every bundled skill globally. The same flow removes existing legacy directories in the user global agent skills location and reports the installation. The bundled skills contain host-specific instructions for AI agents, including Codex browser-tool behavior. This creates an unconsented broad AI-agent control-surface mutation during installation.

AI rationale

The automatic postinstall globally registers package-authored AI-agent instructions and mutates global agent skill directories. This is a concrete unconsented broad AI-agent control-surface write, so it meets the install-hook blocking policy.

Evidence

package.jsonscripts/install.jsscripts/skills.jsskills/short-drama/SKILL.mdscripts/telemetry.jsskills/~/.agents/skills/pippit-short-drama-skill~/.agents/skills/xyq-nest-skill

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/xyq-canvas-command-runtime.cjsView file

2patternName = google_api_key severity = high line = 2

High

High Secret

Package contains a high-severity secret pattern.

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

2patternName = google_api_key severity = high line = 2

High

Secret Pattern

Google API key in dist/xyq-canvas-command-runtime.cjs

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

scripts/telemetry.jsView file

1const os = require("os"); L2: const http = require("http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/telemetry.jsView on unpkg · L1

scripts/skills.jsView file

12Install-time code directly mutates a foreign AI-agent control surface: L12: function defaultGlobalSkillsDir() { L13: return path.join(os.homedir(), ".agents", "skills"); L14: } Write operation from scripts/install.js: L122: L123: fs.mkdirSync(BIN_DIR, { recursive: true }); L124: ... L132: const extracted = path.join(tmpDir, NAME + (isWindows ? ".exe" : "")); L133: fs.copyFileSync(extracted, dest); L134: fs.chmodSync(dest, 0o755); Foreign user/project scope from scripts/skills.js: L12: function defaultGlobalSkillsDir() { L13: return path.join(os.homedir(), ".agents", "skills"); L14: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/skills.jsView on unpkg · L12

skills/xyq-nest-skill/scripts/submit_run.pyView file

•path = skills/xyq-nest-skill/scripts/submit_run.py kind = build_helper sizeBytes = 2374 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/xyq-nest-skill/scripts/submit_run.pyView on unpkg

scripts/canvas-command.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pippit-dev/cli@1.0.11 matchedIdentity = npm:QHBpcHBpdC1kZXYvY2xp:1.0.11 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/canvas-command.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@pippit-dev/cli",

3 "version": "1.0.21",

4 "description": "Pippit CLI",

5 "bin": {

6 "pippit-tool-cli": "scripts/run.js"

7 },

8 "scripts": {

9 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "prepack": "node scripts/prepare-canvas-runtime.js",

11 "prepare:canvas-runtime": "node scripts/prepare-canvas-runtime.js",

12 "test": "node scripts/version-check.test.js && node scripts/skills.test.js && node scripts/install-wizard.test.js && node scripts/canvas-command.test.js && node scripts/prepare-canvas-runtime.test.js && go test ./... && go vet ./...",

13 "verify:canvas-runtime": "node scripts/prepare-canvas-runtime.js --check-only"

14 },

15 "os": [

16 "darwin",

17 "linux",

18 "win32"

19 ],

20 "cpu": [

21 "x64",

22 "arm64"

23 ],

24 "engines": {

25 "node": ">=16"

26 },

27 "repository": {

28 "type": "git",

29 "url": "git+https://github.com/Pippit-dev/cli.git"

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/xyq-canvas-command-runtime.cjsView file

2patternName = google_api_key severity = high line = 2

High

High Secret

Package contains a high-severity secret pattern.

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

2patternName = google_api_key severity = high line = 2

High

Secret Pattern

Google API key in dist/xyq-canvas-command-runtime.cjs

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

scripts/telemetry.jsView file

Lines 1-21javascript

1const os = require("os");

2const http = require("http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/telemetry.jsView on unpkg · L1

3const

scripts/skills.jsView file

Lines 1-32javascript

1const fs = require("fs");

2const os = require("os");

3const path = require

skills/xyq-nest-skill/scripts/submit_run.pyView file

•path = skills/xyq-nest-skill/scripts/submit_run.py kind = build_helper sizeBytes = 2374 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/xyq-nest-skill/scripts/submit_run.pyView on unpkg

scripts/canvas-command.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pippit-dev/cli@1.0.11 matchedIdentity = npm:QHBpcHBpdC1kZXYvY2xp:1.0.11 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/canvas-command.jsView on unpkg