Loading npm security reports…

@rayul/kordis@0.14.0: Malicious npm security report (Block) | LPM Firewall

registry / @rayul/kordis / 0.14.0

@rayul/kordis@0.14.0

Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

Installing the package automatically alters global instruction and skill files for supported AI coding tools. The injected instructions steer future agent sessions to use the Kordis registry.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

Future Claude Code, Codex, and Gemini sessions can be influenced to run this package's registry commands and retrieve registry content.

Mechanism

silent lifecycle-driven global AI-agent instruction injection

Attack narrative

On installation, npm runs postinstall, which silently invokes setup. Setup detects existing global AI-agent directories, then creates or rewrites their instruction files and installs bundled skills. The injected guide tells future agents to consult Kordis for unfamiliar tasks and to run registry commands. This is an unconsented, install-time modification of broad foreign AI-agent control surfaces.

AI rationale

The complete lifecycle path automatically and silently modifies global instruction files for three unrelated AI-agent tools, then injects directives that influence future sessions. This is concrete install-hook abuse rather than an explicit user-invoked setup action.

Evidence

package.jsonscripts/postinstall.mjsdist/index.jsassets/KORDIS.md~/.claude/CLAUDE.md~/.codex/AGENTS.md~/.gemini/GEMINI.md~/.claude/skills/*/SKILL.md~/.codex/skills/*/SKILL.md

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: // merges the hooks section into `.claude/settings.json` target: ".claude/settings.json" // `mcpToCodex` merges `.codex/config.toml` (`:103-109`), `mcpToContinue` target: ".codex/config.toml" // still knows how to write `.claude/judgments/<name>.md`, and it is kept. baseUrl; this.baseUrl = config.baseUrl.replace(/\/$/, ""); if (token) headers.authorization = `Bearer ${token}`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @rayul/kordis@0.14.1 matchedPath = dist/index.js matchedIdentity = npm:QHJheXVsL2tvcmRpcw:0.14.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 99bd6c937149be35 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @rayul/kordis@0.14.1 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QHJheXVsL2tvcmRpcw:0.14.1 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.mjsView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 7-47json

7 "homepage": "https://kordis.store",

8 "type": "module",

9 "bin": {

10 "kordis": "bin/kordis.js"

11 },

12 "main": "./dist/index.js",

13 "files": [

14 "bin",

15 "dist",

16 "assets",

17 "scripts",

18 "README.md",

19 "LICENSE",

20 "NOTICE"

21 ],

22 "scripts": {

23 "dev": "tsx src/index.ts",

24 "build": "tsup && rm -rf assets && mkdir -p assets && cp -R ../../packages/skills/. assets/",

25 "typecheck": "tsc --noEmit",

26 "test": "vitest run",

27 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "prepublishOnly": "pnpm build"

29 },

30 "dependencies": {

31 "@iarna/toml": "^2.2.5",

32 "commander": "^12.1.0",

33 "jszip": "^3.10.1",

34 "kleur": "^4.1.5",

35 "open": "^10.1.0",

36 "ora": "^8.1.1",

37 "prompts": "^2.4.2",

38 "semver": "^7.8.4",

39 "yaml": "^2.9.0",

40 "zod": "^3.23.8"

41 },

42 "optionalDependencies": {

43 "keytar": "7.9.0"

44 },

45 "devDependencies": {

46 "@kordis/api-client": "workspace:*",

47 "@kordis/config": "workspace:*",

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: // merges the hooks section into `.claude/settings.json` target: ".claude/settings.json" // `mcpToCodex` merges `.codex/config.toml` (`:103-109`), `mcpToContinue` target: ".codex/config.toml" // still knows how to write `.claude/judgments/<name>.md`, and it is kept. baseUrl; this.baseUrl = config.baseUrl.replace(/\/$/, ""); if (token) headers.authorization = `Bearer ${token}`;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @rayul/kordis@0.14.1 matchedPath = dist/index.js matchedIdentity = npm:QHJheXVsL2tvcmRpcw:0.14.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

scripts/postinstall.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 99bd6c937149be35 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @rayul/kordis@0.14.1 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:QHJheXVsL2tvcmRpcw:0.14.1 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/postinstall.mjsView on unpkg