registry / @roarpeng/graphflow / 1.3.4

@roarpeng/graphflow@1.3.4

**A Context-Aware Multi-Agent Orchestration Engine**

AI Security Review

scanned 7h ago · by lpm-firewall-ai

The package runs a postinstall script that mutates broad user/home AI-agent control surfaces. It installs GraphFlow skill/rule/instruction files and registers MCP configuration for detected agents.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install, especially global install or first/version-changed install

Impact

Can plant package-supplied instructions/MCP registrations into existing agent environments without an explicit CLI opt-in.

Mechanism

unconsented lifecycle AI-agent control-surface mutation

Attack narrative

On npm postinstall, safe-postinstall.cjs detects installed AI tools and copies package-supplied skills/rules into their user/home control directories, writes a home version marker, and shells into an MCP installer that registers GraphFlow using an npx strategy. Under the firewall policy this lifecycle-triggered mutation of foreign/broad agent surfaces is blockable even if the content is product-aligned.

Rationale

Source inspection confirms package.json lifecycle execution and install-time writes/registration into Trae, Cursor, Claude/MCP-style agent surfaces outside the package namespace. This matches the policy’s unconsented lifecycle AI-agent control hijack category rather than a noisy scanner-only finding.

Evidence

package.jsonscripts/safe-postinstall.cjsdist/integrations/agent-mcp-installer.jsdist/surfaces/trae-skill/graphflow/SKILL.mddist/surfaces/cursor-rules/graphflow.mdcCLAUDE.md~/.graphflow-install-version~/.config/Trae/User/skills/graphflow/SKILL.md~/.config/Trae CN/User/skills/graphflow/SKILL.md~/.cursor/rules/graphflow.mdc%APPDATA%/Cursor/User/rules/graphflow.mdcCLAUDE.md agent instruction targets via installer

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

package.json defines postinstall: node scripts/safe-postinstall.cjs.
scripts/safe-postinstall.cjs writes ~/.graphflow-install-version and copies package files into home AI-agent locations.
postinstall invokes dist/integrations/agent-mcp-installer.js with strategy npx via spawnSync.
scripts/safe-postinstall.cjs targets Trae skills, Cursor rules, and CLAUDE.md agent control surfaces.

Evidence against

Postinstall checks version/global/install markers and existing app directories before many writes.
No direct credential harvesting found in inspected lifecycle script.
Network behavior observed is npx MCP registration command construction, not direct exfiltration.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 127 file(s), 815 KB of source, external domains: api.anthropic.com, api.deepseek.com, api.openai.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com, huggingface.co

Source & flagged code

4 flagged

package.jsonView file

Lines 11-51json

11 "src/surfaces/trae-skill",

12 "src/surfaces/cursor-rules",

13 "README.md",

14 "LICENSE",

15 "CHANGELOG.md",

16 "AGENTS.md",

17 "CLAUDE.md"

18 ],

19 "packageManager": "npm@10.9.2",

20 "description": "**A Context-Aware Multi-Agent Orchestration Engine**",

21 "main": "dist/index.js",

22 "types": "dist/index.d.ts",

23 "bin": {

24 "graphflow": "dist/surfaces/cli/index.js",

25 "graphflow-mcp": "dist/surfaces/mcp/server.js"

26 },

27 "directories": {

28 "doc": "docs"

29 },

30 "scripts": {

31 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "prepublishOnly": "npm run build",

33 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

34 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

35 "test": "vitest run",

36 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

37 "test:watch": "vitest",

38 "start": "tsx src/surfaces/cli/index.ts",

39 "start:mcp": "tsx src/surfaces/mcp/server.ts",

40 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

41 "lint": "eslint .",

42 "build:extension": "npm --prefix vscode-extension run build",

43 "test:extension": "npm --prefix vscode-extension run test:runtime",

44 "package:extension": "npm --prefix vscode-extension run package",

45 "ci": "npm run lint && npm run build && npm test && npm run build:extension && npm run test:extension",

46 "prepare": "husky"

47 },

48 "lint-staged": {

49 "*.ts": "eslint --fix"

50 },

51 "repository": {

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

11 *

12 * 向后兼容：当图存储不支持 checkpoint 所需操作（getNodesByIds / upsertNodes）时，

13 * 所有 checkpoint 操作都会优雅降级为纯内存执行，不会抛出错误。

14 */

15Object.defineProperty(exports, "__esModule", { value: true });

16exports.DagCheckpoint = void 0;

17exports.computeTaskHash = computeTaskHash;

18exports.computeDagId = computeDagId;

19const logger_1 = require("../utils/logger");

20const hash_1 = require("../utils/hash");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/dag-checkpoint.jsView on unpkg · L18

21/**

22 * 计算 DAG 计划的任务哈希。

23 *

24 * 哈希输入为所有节点的 id / description / dependencies 的规范化拼接，

25 * 保证相同计划产生相同哈希，从而命中同一 checkpoint。

26 */

27function computeTaskHash(plan) {

28 const normalized = plan

29 .map((node) => `${node.id}|${node.description}|${[...node.dependencies].sort().join(",")}`)

30 .sort()

31 .join("||");

32 return (0, hash_1.hashText)(normalized);

33}

34/**

35 * 根据计划生成 checkpoint ID，格式 `dag:${taskHash}`。

36 */

37function computeDagId(plan) {

38 return `dag:${computeTaskHash(plan)}`;

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join } = require("node:path");

4const { homedir } = require("node:os");

5const { spawnSync } = require("node:child_process");

7const isWindows = process.platform === "win32";

9// ─── 版本比较与自动更新 ───

11/** 版本标记文件路径：记录上次安装的 GraphFlow 版本号 */

12const VERSION_FILE = join(homedir(), ".graphflow-install-version");

14/**

15 * 读取上次安装时记录的版本号

16 * @returns {string | null} 上次版本号，不存在则返回 null

17 */

18function readPreviousVersion() {

19 try {

20 if (existsSync(VERSION_FILE)) {

21 return readFileSync(VERSION_FILE, "utf8").trim();

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/safe-postinstall.cjsView on unpkg · L1

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/safe-postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/core/dag-checkpoint.jsView file

18exports.computeDagId = computeDagId; L19: const logger_1 = require("../utils/logger"); L20: const hash_1 = require("../utils/hash");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/dag-checkpoint.jsView on unpkg · L18

scripts/safe-postinstall.cjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs"); L3: const { join } = require("node:path"); ... L34: try { L35: writeFileSync(VERSION_FILE, version, "utf8"); L36: } catch { ... L130: L131: mkdirSync(skillDestDir, { recursive: true }); L132: copyFileSync(sk[redacted], skillDestFile); L133: ... L217: /** L218: * 获取 CLAUDE.md 源文件路径 Payload evidence from dist/integrations/agent-mcp-installer.js: L16: exports.formatModelConfigGuide = formatModelConfigGuide; L17: const node_child_process_1 = require("node:child_process"); L18: const node_fs_1 = require("node:fs"); ... L21: function isWindows() { L22: return process.platform === "win32"; L23: } ... L54: try { L55: const output = (0, node_child_process_1.execFileSync)("cmd.exe", ["/c", "echo %USERPROFILE%"], { L56: encoding: "utf8", ... L74: const home = (0, node_os_1.homedir)(); L75: const appData = process.env.APPDATA ?? (isWindows() ? (0, node_path_1.join)(home, "AppData", "Roaming") : ""); L76: const localAppData = process.env.LOCALAPPDATA ?? (isWindows() ? (0, node_path_1.join)(home, "AppData", "Loc…

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/safe-postinstall.cjsView on unpkg · L1

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

Findings

1 Critical1 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/safe-postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

MediumDynamic Requiredist/core/dag-checkpoint.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulewasm/tree-sitter-go.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

package.jsonView file

Lines 11-51json

11 "src/surfaces/trae-skill",

12 "src/surfaces/cursor-rules",

13 "README.md",

14 "LICENSE",

15 "CHANGELOG.md",

16 "AGENTS.md",

17 "CLAUDE.md"

18 ],

19 "packageManager": "npm@10.9.2",

20 "description": "**A Context-Aware Multi-Agent Orchestration Engine**",

21 "main": "dist/index.js",

22 "types": "dist/index.d.ts",

23 "bin": {

24 "graphflow": "dist/surfaces/cli/index.js",

25 "graphflow-mcp": "dist/surfaces/mcp/server.js"

26 },

27 "directories": {

28 "doc": "docs"

29 },

30 "scripts": {

31 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "prepublishOnly": "npm run build",

33 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

34 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

35 "test": "vitest run",

36 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

37 "test:watch": "vitest",

38 "start": "tsx src/surfaces/cli/index.ts",

39 "start:mcp": "tsx src/surfaces/mcp/server.ts",

40 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

41 "lint": "eslint .",

42 "build:extension": "npm --prefix vscode-extension run build",

43 "test:extension": "npm --prefix vscode-extension run test:runtime",

44 "package:extension": "npm --prefix vscode-extension run package",

45 "ci": "npm run lint && npm run build && npm test && npm run build:extension && npm run test:extension",

46 "prepare": "husky"

47 },

48 "lint-staged": {

49 "*.ts": "eslint --fix"

50 },

51 "repository": {

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

11 *

12 * 向后兼容：当图存储不支持 checkpoint 所需操作（getNodesByIds / upsertNodes）时，

13 * 所有 checkpoint 操作都会优雅降级为纯内存执行，不会抛出错误。

14 */

15Object.defineProperty(exports, "__esModule", { value: true });

16exports.DagCheckpoint = void 0;

17exports.computeTaskHash = computeTaskHash;

18exports.computeDagId = computeDagId;

19const logger_1 = require("../utils/logger");

20const hash_1 = require("../utils/hash");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/dag-checkpoint.jsView on unpkg · L18

21/**

22 * 计算 DAG 计划的任务哈希。

23 *

24 * 哈希输入为所有节点的 id / description / dependencies 的规范化拼接，

25 * 保证相同计划产生相同哈希，从而命中同一 checkpoint。

26 */

27function computeTaskHash(plan) {

28 const normalized = plan

29 .map((node) => `${node.id}|${node.description}|${[...node.dependencies].sort().join(",")}`)

30 .sort()

31 .join("||");

32 return (0, hash_1.hashText)(normalized);

33}

34/**

35 * 根据计划生成 checkpoint ID，格式 `dag:${taskHash}`。

36 */

37function computeDagId(plan) {

38 return `dag:${computeTaskHash(plan)}`;

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join } = require("node:path");

4const { homedir } = require("node:os");

5const { spawnSync } = require("node:child_process");

7const isWindows = process.platform === "win32";

9// ─── 版本比较与自动更新 ───

11/** 版本标记文件路径：记录上次安装的 GraphFlow 版本号 */

12const VERSION_FILE = join(homedir(), ".graphflow-install-version");

14/**

15 * 读取上次安装时记录的版本号

16 * @returns {string | null} 上次版本号，不存在则返回 null

17 */

18function readPreviousVersion() {

19 try {

20 if (existsSync(VERSION_FILE)) {

21 return readFileSync(VERSION_FILE, "utf8").trim();

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/safe-postinstall.cjsView on unpkg · L1

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg