Loading npm security reports…

@roarpeng/graphflow@1.15.5: Malicious npm security report (Block) | LPM Firewall

registry / @roarpeng/graphflow / 1.15.5

@roarpeng/graphflow@1.15.5

Local-first memory & context harness for coding agents

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installation automatically alters existing workspace and detected user agent MCP configuration. The added entry causes agent clients to launch GraphFlow through npx.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation, when matching agent configuration files exist.

Impact

A package installation can persist an executable MCP server and behavioral instructions in existing coding-agent environments without an explicit setup command.

Mechanism

Automatic MCP and agent-instruction injection into foreign agent control surfaces.

Attack narrative

The package registers postinstall. During a normal local installation, it examines the consumer workspace for existing Cursor, VS Code, or Opencode MCP configuration and inserts a GraphFlow server entry that runs npx with this package. Its installer also detects supported user-level agent configurations and injects MCP registrations. The bundled AGENTS.md then directs coding agents to use GraphFlow and report outcomes. This is unconsented install-time mutation of broad foreign AI-agent control surfaces.

AI rationale

The automatic lifecycle hook modifies existing agent configurations and installs a package-controlled MCP command without an explicit user setup action. This meets the install-hook abuse blocking boundary.

Evidence

package.jsonscripts/safe-postinstall.cjsdist/integrations/agent-mcp-installer.jsAGENTS.md.cursor/mcp.json.vscode/mcp.json.opencode/opencode.json~/.claude.json

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/safe-postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/core/dag-checkpoint.jsView file

18exports.computeDagId = computeDagId; L19: const logger_1 = require("../utils/logger"); L20: const hash_1 = require("../utils/hash");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/dag-checkpoint.jsView on unpkg · L18

scripts/safe-postinstall.cjsView file

1#!/usr/bin/env node L2: const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs"); L3: const { join } = require("node:path"); ... L34: try { L35: writeFileSync(VERSION_FILE, version, "utf8"); L36: } catch { ... L130: L131: mkdirSync(skillDestDir, { recursive: true }); L132: copyFileSync(sk[redacted], skillDestFile); L133: ... L242: /** L243: * 获取 CLAUDE.md 源文件路径

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/safe-postinstall.cjsView on unpkg · L1

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/agents/insight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/insight.js#virtual:normalized:round1View on unpkg

dist/integrations/agent-profiles/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.9.13 matchedPath = dist/integrations/agent-profiles/utils.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.9.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-profiles/utils.jsView on unpkg

dist/integrations/ensure-anydoc.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.9.13 matchedPath = dist/integrations/ensure-anydoc.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.9.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ensure-anydoc.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 36-76json

36 "types": "dist/index.d.ts",

37 "exports": {

38 ".": {

39 "types": "./dist/index.d.ts",

40 "default": "./dist/index.js"

41 },

42 "./dsh": "./dsh/plugin.mjs",

43 "./dsh/package.json": "./package.json",

44 "./web": "./web/plugin.mjs",

45 "./client": "./dsh/client.js",

46 "./package.json": "./package.json"

47 },

48 "bin": {

49 "graphflow": "dist/surfaces/cli/index.js",

50 "graphflow-mcp": "dist/surfaces/mcp/server.js"

51 },

52 "directories": {

53 "doc": "docs"

54 },

55 "scripts": {

56 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

57 "prepublishOnly": "npm run build",

58 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

59 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

60 "test": "vitest run",

61 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

62 "test:watch": "vitest",

63 "start": "tsx src/surfaces/cli/index.ts",

64 "start:mcp": "tsx src/surfaces/mcp/server.ts",

65 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

66 "benchmark:skills": "tsx benchmarks/run-skill-ab-benchmark.ts",

67 "benchmark:ab": "tsx benchmarks/run-skill-ab.ts",

68 "benchmark:memory": "tsx benchmarks/run-memory-ab.ts",

69 "benchmark:retrieval": "tsx benchmarks/run-retrieval-eval.ts",

70 "benchmark:comprehensive": "tsx benchmarks/run-comprehensive-bench.ts",

71 "benchmark:independent": "tsx benchmarks/run-independent-bench.ts",

72 "benchmark:swe-bench": "tsx benchmarks/run-swe-bench-eval.ts",

73 "benchmark:swe-bench-real": "tsx benchmarks/run-swe-bench-real.ts",

74 "benchmark:swe-bench-agent": "tsx benchmarks/run-swe-bench-agent.ts",

75 "bench:retrieval": "tsx benchmarks/run-retrieval-eval.ts",

76 "bench:token": "tsx benchmarks/run-token-benchmark.ts",

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join }

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/agents/insight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/insight.js#virtual:normalized:round1View on unpkg

dist/integrations/agent-profiles/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.9.13 matchedPath = dist/integrations/agent-profiles/utils.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.9.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-profiles/utils.jsView on unpkg

dist/integrations/ensure-anydoc.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.9.13 matchedPath = dist/integrations/ensure-anydoc.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.9.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ensure-anydoc.jsView on unpkg