Loading npm security reports…

@pippit-dev/cli@1.0.24: AI-agent control-surface risk | LPM Firewall

registry / @pippit-dev/cli / 1.0.24

@pippit-dev/cli@1.0.24

Pippit CLI

AI Security Review

scanned 23d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package triggers a postinstall that globally registers all bundled AI-agent skills without an explicit user setup command. It also downloads a native executable and sends install telemetry.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm installation that permits postinstall scripts.

Impact

The package can alter the behavior and capabilities of agents using the shared global skills directory; the installer also adds a remotely downloaded native binary.

Mechanism

Postinstall invokes npx to add package skills globally under the user's agent configuration.

Policy narrative

A normal npm install runs scripts/install.js. Unless an opt-out environment variable is already set, it calls npx skills add with global and all-skills options, placing this package's agent instructions in the user's home .agents/skills control surface. This occurs without an explicit setup command. The same lifecycle path downloads and installs a native executable and reports installation telemetry. The global agent mutation is sufficient to create an unconsented AI-agent control-surface risk.

AI rationale

This is a concrete unconsented postinstall mutation of a broad, foreign AI-agent skills directory. Checksum verification and limited telemetry do not remove the risk created by automatic global skill registration.

Evidence

package.jsonscripts/install.jsscripts/skills.jsscripts/telemetry.jsbin/pippit-tool-cli~/.agents/skills

Network endpoints2

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/xyq-canvas-command-runtime.cjsView file

2patternName = google_api_key severity = high line = 2

High

High Secret

Package contains a high-severity secret pattern.

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

2patternName = google_api_key severity = high line = 2

High

Secret Pattern

Google API key in dist/xyq-canvas-command-runtime.cjs

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

scripts/install-cli.jsView file

2L3: const { install } = require("./install"); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install-cli.jsView on unpkg · L2

scripts/skills.jsView file

12Install-time code directly mutates a foreign AI-agent control surface: L12: function defaultGlobalSkillsDir() { L13: return path.join(os.homedir(), ".agents", "skills"); L14: } Write operation from scripts/install.js: L122: L123: fs.mkdirSync(BIN_DIR, { recursive: true }); L124: ... L132: const extracted = path.join(tmpDir, NAME + (isWindows ? ".exe" : "")); L133: fs.copyFileSync(extracted, dest); L134: fs.chmodSync(dest, 0o755); Foreign user/project scope from scripts/skills.js: L12: function defaultGlobalSkillsDir() { L13: return path.join(os.homedir(), ".agents", "skills"); L14: }

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/skills.jsView on unpkg · L12

skills/xyq-nest-skill/scripts/xyq_common.pyView file

•path = skills/xyq-nest-skill/scripts/xyq_common.py kind = build_helper sizeBytes = 5490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/xyq-nest-skill/scripts/xyq_common.pyView on unpkg

scripts/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pippit-dev/cli@1.0.22 matchedIdentity = npm:QHBpcHBpdC1kZXYvY2xp:1.0.22 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@pippit-dev/cli",

3 "version": "1.0.24",

4 "description": "Pippit CLI",

5 "bin": {

6 "pippit-tool-cli": "scripts/run.js"

7 },

8 "scripts": {

9 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "prepack": "node scripts/prepare-canvas-runtime.js",

11 "prepare:canvas-runtime": "node scripts/prepare-canvas-runtime.js",

12 "test": "node scripts/version-check.test.js && node scripts/skills.test.js && node scripts/install-wizard.test.js && node scripts/install-cli.test.js && node scripts/run-help.test.js && node scripts/canvas-command.test.js && node scripts/canvas-command-schema.test.js && node scripts/canvas-command-guides.test.js && node scripts/prepare-canvas-runtime.test.js && node scripts/canvas-command-runtime.test.js && npm run test:canvas-operations && go test ./... && go vet ./...",

13 "verify:canvas-runtime": "node scripts/prepare-canvas-runtime.js --check-only",

14 "test:canvas-runtime": "node scripts/canvas-command-runtime.test.js",

15 "test:canvas-operations": "node scripts/canvas-command-canvas-operations.test.js && node scripts/canvas-command-scene3d-operations.test.js && node scripts/canvas-command-timeline-operations.test.js"

16 },

17 "os": [

18 "darwin",

19 "linux",

20 "win32"

21 ],

22 "cpu": [

23 "x64",

24 "arm64"

25 ],

26 "engines": {

27 "node": ">=16"

28 },

29 "repository": {

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/xyq-canvas-command-runtime.cjsView file

2patternName = google_api_key severity = high line = 2

High

High Secret

Package contains a high-severity secret pattern.

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

2patternName = google_api_key severity = high line = 2

High

Secret Pattern

Google API key in dist/xyq-canvas-command-runtime.cjs

dist/xyq-canvas-command-runtime.cjsView on unpkg · L2

scripts/install-cli.jsView file

Lines 1-20javascript

1#!/usr/bin/env node

2

3const { install } = require("./install");

4

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install-cli.jsView on unpkg · L2

5if (require.main === module) {

scripts/skills.jsView file

Lines 1-32javascript

1const fs = require("fs");

2const os = require("os");

3const path = require

skills/xyq-nest-skill/scripts/xyq_common.pyView file

•path = skills/xyq-nest-skill/scripts/xyq_common.py kind = build_helper sizeBytes = 5490 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/xyq-nest-skill/scripts/xyq_common.pyView on unpkg

scripts/install.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @pippit-dev/cli@1.0.22 matchedIdentity = npm:QHBpcHBpdC1kZXYvY2xp:1.0.22 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/install.jsView on unpkg