Loading npm security reports…

@roarpeng/graphflow@1.17.1: AI-agent control-surface risk | LPM Firewall

registry / @roarpeng/graphflow / 1.17.1

@roarpeng/graphflow@1.17.1

Local-first memory & context harness for coding agents

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall hook that modifies existing third-party AI-agent MCP configuration files. It registers an npx command that automatically starts GraphFlow for future agent sessions.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation when an existing supported workspace MCP configuration is present; global installation also invokes setup.

Impact

The package gains automatic execution within foreign AI-agent control surfaces and can constrain agent workflows without an explicit setup command.

Mechanism

Automatic postinstall injection of GraphFlow MCP entries and agent rules.

Policy narrative

The package declares a postinstall script. On a normal local install, it checks the consumer project for existing Cursor, VS Code, or OpenCode MCP configuration and adds a GraphFlow MCP server that launches the package through npx. Its installer also detects supported agents and writes their configuration entries. It installs always-applied agent rules directing agents to use GraphFlow before exploration or review. These are unconsented, automatic changes to foreign AI-agent control surfaces.

AI rationale

The inspected source establishes an automatic npm lifecycle chain that writes third-party agent configuration and rules, producing persistent automatic package execution. This meets the install-hook abuse boundary even though direct secret exfiltration was not confirmed.

Evidence

package.jsonscripts/safe-postinstall.cjsdist/integrations/agent-mcp-installer.jsdist/surfaces/trae-rules/graphflow.md.cursor/mcp.json

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/safe-postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/core/dag-checkpoint.jsView file

18exports.computeDagId = computeDagId; L19: const logger_1 = require("../utils/logger"); L20: const hash_1 = require("../utils/hash");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/dag-checkpoint.jsView on unpkg · L18

scripts/safe-postinstall.cjsView file

1#!/usr/bin/env node L2: const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs"); L3: const { join } = require("node:path"); ... L34: try { L35: writeFileSync(VERSION_FILE, version, "utf8"); L36: } catch { ... L130: L131: mkdirSync(skillDestDir, { recursive: true }); L132: copyFileSync(sk[redacted], skillDestFile); L133: ... L242: /** L243: * 获取 CLAUDE.md 源文件路径

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/safe-postinstall.cjsView on unpkg · L1

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/agents/insight.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/agents/insight.js#virtual:normalized:round1View on unpkg

dist/integrations/agent-mcp-installer.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/integrations/agent-mcp-installer.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-mcp-installer.jsView on unpkg

dist/integrations/agent-profiles/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/integrations/agent-profiles/utils.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-profiles/utils.jsView on unpkg

dist/integrations/dsh-harness-installer.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/integrations/dsh-harness-installer.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/dsh-harness-installer.jsView on unpkg

dist/integrations/ensure-anydoc.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/integrations/ensure-anydoc.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/ensure-anydoc.jsView on unpkg

dist/config/loader.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.16.0 matchedPath = dist/config/loader.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.16.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/config/loader.jsView on unpkg

dist/surfaces/mcp/server.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.16.0 matchedPath = dist/surfaces/mcp/server.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.16.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/mcp/server.jsView on unpkg

dist/learning/embeddings.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/learning/embeddings.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/learning/embeddings.jsView on unpkg

dist/surfaces/cli/index.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.16.0 matchedPath = dist/surfaces/cli/index.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.16.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/cli/index.jsView on unpkg

dist/surfaces/cli/runtime/governance.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.16.0 matchedPath = [redacted].js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.16.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/cli/runtime/governance.jsView on unpkg

dist/surfaces/team/ops.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/surfaces/team/ops.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/team/ops.jsView on unpkg

dist/surfaces/team/server.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.18.1 matchedPath = dist/surfaces/team/server.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.18.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/surfaces/team/server.jsView on unpkg

dsh/plugin.mjsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.16.0 matchedPath = dsh/plugin.mjs matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.16.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dsh/plugin.mjsView on unpkg