registry / @roarpeng/graphflow / 1.4.0

@roarpeng/graphflow@1.4.0

**A Context-Aware Multi-Agent Orchestration Engine**

AI Security Review

scanned 4h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. The package has lifecycle-triggered AI-agent control-surface mutation. On install it can register its MCP server and copy package-supplied agent instructions/rules into workspace or user-level agent configuration files.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm postinstall during package installation, especially global install, GRAPHFLOW_ENABLE_POSTINSTALL=1, or local install in a workspace with existing .cursor/.vscode MCP config

Impact

AI coding agents may automatically expose GraphFlow tools and package-supplied instructions through broad foreign control surfaces after installation.

Mechanism

unconsented MCP/agent instruction registration from lifecycle script

Policy narrative

Installing the package runs a postinstall script. When conditions indicate global/explicit setup, or when local workspace MCP files already exist, the script writes GraphFlow MCP entries and copies package-supplied agent instruction files into multiple AI agent control surfaces. This is not mere CLI-invoked setup; the lifecycle path performs the mutation automatically under common install conditions.

Rationale

Source inspection confirms lifecycle code writes or rewrites broad foreign AI-agent MCP/config/instruction surfaces, which matches the blockable AI-agent control hijack policy. The behavior is package-aligned but still unconsented lifecycle delivery into agent control surfaces.

Evidence

package.jsonscripts/safe-postinstall.cjsdist/integrations/agent-mcp-installer.jsCLAUDE.mddist/surfaces/cursor-rules/graphflow.mdcdist/surfaces/trae-skill/graphflow/SKILL.md.cursor/mcp.json.vscode/mcp.json.graphflow/skills/graphflow/SKILL.md.cursor/rules/graphflow.mdc~/.claude.json~/.claude/CLAUDE.md~/.codex/config.toml~/.gemini/settings.json~/.codeium/windsurf/mcp_config.json

Network endpoints4

api.openai.com/v1api.anthropic.comdashscope.aliyuncs.com/compatible-mode/v1ark.cn-beijing.volces.com/api/v3

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for policy block

package.json runs postinstall: node scripts/safe-postinstall.cjs
scripts/safe-postinstall.cjs auto-injects GraphFlow MCP into existing workspace .cursor/mcp.json and .vscode/mcp.json during local install
global/explicit postinstall calls installMcpToDetectedAgents, which writes user MCP configs for Claude Code, Codex, Cursor, VS Code, Gemini, Cline, Roo Code, Kilo Code, Windsurf, etc.
postinstall copies package-supplied CLAUDE.md to ~/.claude/CLAUDE.md and Cursor rules to ~/.cursor/rules/graphflow.mdc when markers exist
dist/integrations/agent-mcp-installer.js creates or updates broad AI-agent control files, including ~/.claude.json and ~/.codex/config.toml
MCP entries launch npx -y --package=@roarpeng/graphflow graphflow-mcp

Evidence against

Postinstall skips in CI or GRAPHFLOW_SKIP_POSTINSTALL=1
Local install without existing workspace MCP config prints manual install guidance instead of global mutation
Network calls in provider adapters use user API keys for package-aligned LLM features
No credential harvesting or arbitrary remote payload execution found beyond registering its own MCP server

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 720 KB of source, external domains: api.anthropic.com, api.deepseek.com, api.openai.com, ark.cn-beijing.volces.com, dashscope.aliyuncs.com

Source & flagged code

5 flagged

package.jsonView file

Lines 11-51json

11 "src/surfaces/trae-skill",

12 "src/surfaces/cursor-rules",

13 "README.md",

14 "LICENSE",

15 "CHANGELOG.md",

16 "AGENTS.md",

17 "CLAUDE.md"

18 ],

19 "packageManager": "npm@10.9.2",

20 "description": "**A Context-Aware Multi-Agent Orchestration Engine**",

21 "main": "dist/index.js",

22 "types": "dist/index.d.ts",

23 "bin": {

24 "graphflow": "dist/surfaces/cli/index.js",

25 "graphflow-mcp": "dist/surfaces/mcp/server.js"

26 },

27 "directories": {

28 "doc": "docs"

29 },

30 "scripts": {

31 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "prepublishOnly": "npm run build",

33 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

34 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

35 "test": "vitest run",

36 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

37 "test:watch": "vitest",

38 "start": "tsx src/surfaces/cli/index.ts",

39 "start:mcp": "tsx src/surfaces/mcp/server.ts",

40 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

41 "lint": "eslint .",

42 "build:extension": "npm --prefix vscode-extension run build",

43 "test:extension": "npm --prefix vscode-extension run test:runtime",

44 "package:extension": "npm --prefix vscode-extension run package",

45 "ci": "npm run lint && npm run build && npm test && npm run build:extension && npm run test:extension",

46 "prepare": "husky"

47 },

48 "lint-staged": {

49 "*.ts": "eslint --fix"

50 },

51 "repository": {

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

11 *

12 * 向后兼容：当图存储不支持 checkpoint 所需操作（getNodesByIds / upsertNodes）时，

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join } = require("node:path");

4const { homedir

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/integrations/agent-mcp-installer.jsView file

•matchType = normalized_sha256 matchedPackage = @roarpeng/graphflow@1.3.4 matchedPath = dist/integrations/agent-mcp-installer.js matchedIdentity = npm:QHJvYXJwZW5nL2dyYXBoZmxvdw:1.3.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-mcp-installer.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/safe-postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/core/dag-checkpoint.jsView file

18exports.computeDagId = computeDagId; L19: const logger_1 = require("../utils/logger"); L20: const hash_1 = require("../utils/hash");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/dag-checkpoint.jsView on unpkg · L18

scripts/safe-postinstall.cjsView file

1Install-time AI-agent control hijack evidence: L1: #!/usr/bin/env node L2: const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs"); L3: const { join } = require("node:path"); ... L34: try { L35: writeFileSync(VERSION_FILE, version, "utf8"); L36: } catch { ... L130: L131: mkdirSync(skillDestDir, { recursive: true }); L132: copyFileSync(sk[redacted], skillDestFile); L133: ... L217: /** L218: * 获取 CLAUDE.md 源文件路径 Payload evidence from dist/integrations/agent-mcp-installer.js: L16: exports.formatModelConfigGuide = formatModelConfigGuide; L17: const node_child_process_1 = require("node:child_process"); L18: const node_fs_1 = require("node:fs"); ... L21: function isWindows() { L22: return process.platform === "win32"; L23: } ... L54: try { L55: const output = (0, node_child_process_1.execFileSync)("cmd.exe", ["/c", "echo %USERPROFILE%"], { L56: encoding: "utf8", ... L74: const home = (0, node_os_1.homedir)(); L75: const appData = process.env.APPDATA ?? (isWindows() ? (0, node_path_1.join)(home, "AppData", "Roaming") : ""); L76: const localAppData = process.env.LOCALAPPDATA ?? (isWindows() ? (0, node_path_1.join)(home, "AppData", "Loc…

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

scripts/safe-postinstall.cjsView on unpkg · L1

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/integrations/agent-mcp-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-mcp-installer.jsView on unpkg

Findings

1 Critical2 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/safe-postinstall.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/integrations/agent-mcp-installer.js

MediumDynamic Requiredist/core/dag-checkpoint.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulewasm/tree-sitter-go.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 11-51json

11 "src/surfaces/trae-skill",

12 "src/surfaces/cursor-rules",

13 "README.md",

14 "LICENSE",

15 "CHANGELOG.md",

16 "AGENTS.md",

17 "CLAUDE.md"

18 ],

19 "packageManager": "npm@10.9.2",

20 "description": "**A Context-Aware Multi-Agent Orchestration Engine**",

21 "main": "dist/index.js",

22 "types": "dist/index.d.ts",

23 "bin": {

24 "graphflow": "dist/surfaces/cli/index.js",

25 "graphflow-mcp": "dist/surfaces/mcp/server.js"

26 },

27 "directories": {

28 "doc": "docs"

29 },

30 "scripts": {

31 "postinstall": "node scripts/safe-postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "prepublishOnly": "npm run build",

33 "wasm:bundle": "node scripts/bundle-wasm-grammars.cjs",

34 "wasm:download": "node scripts/bundle-wasm-grammars.cjs",

35 "test": "vitest run",

36 "build": "npm run wasm:bundle && tsc -p tsconfig.json && node scripts/copy-assets.cjs",

37 "test:watch": "vitest",

38 "start": "tsx src/surfaces/cli/index.ts",

39 "start:mcp": "tsx src/surfaces/mcp/server.ts",

40 "benchmark": "tsx benchmarks/run-token-benchmark.ts",

41 "lint": "eslint .",

42 "build:extension": "npm --prefix vscode-extension run build",

43 "test:extension": "npm --prefix vscode-extension run test:runtime",

44 "package:extension": "npm --prefix vscode-extension run package",

45 "ci": "npm run lint && npm run build && npm test && npm run build:extension && npm run test:extension",

46 "prepare": "husky"

47 },

48 "lint-staged": {

49 "*.ts": "eslint --fix"

50 },

51 "repository": {

dist/core/dag-checkpoint.jsView file

Lines 1-38javascript

1"use strict";

2/**

3 * dag-checkpoint.ts — DAG 执行状态持久化（Checkpoint）

4 *

5 * 在每个 DAG 节点执行完成后，将节点状态（id, status, result, retryCount, executedAt）

6 * 持久化到图存储中（作为 TaskRun 类型的 GraphNode）。

7 *

8 * Checkpoint ID 使用 `dag:${taskHash}` 格式：

9 * - taskHash 由 DAG 计划（节点 id / 描述 / 依赖）计算得出，保证同一计划可恢复。

10 * - 整个 DAG 的 checkpoint 以单个 TaskRun GraphNode 的形式存储，content 字段为 JSON。

11 *

12 * 向后兼容：当图存储不支持 checkpoint 所需操作（getNodesByIds / upsertNodes）时，

scripts/safe-postinstall.cjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { existsSync, mkdirSync, copyFileSync, readFileSync, writeFileSync, unlinkSync } = require("node:fs");

3const { join } = require("node:path");

4const { homedir

wasm/tree-sitter-go.wasmView file

•path = wasm/tree-sitter-go.wasm kind = wasm_module sizeBytes = 235957 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter-go.wasmView on unpkg

dist/integrations/agent-mcp-installer.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/integrations/agent-mcp-installer.jsView on unpkg