Loading npm security reports…

@roopesh.yadava/qa-pack@1.6.0: AI-agent control-surface risk | LPM Firewall

registry / @roopesh.yadava/qa-pack / 1.6.0

@roopesh.yadava/qa-pack@1.6.0

AI-powered QA agent skills for Claude Code — manual testing, BDD automation, accessibility, UI/Figma diff, bug reporting

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the consumer project's Claude control surface. It installs skills and commands, seeds MCP settings, and forces an MCP auto-approval permission.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation invokes the postinstall lifecycle script.

Impact

A package installation can expand an AI agent's available tools and approval state without an explicit setup command from the project owner.

Mechanism

Install-time mutation of project Claude configuration and permission settings.

Policy narrative

The npm postinstall hook runs automatically in the consumer project. It copies version-controlled skills and commands into .claude, creates local MCP configuration, and modifies existing settings.local.json to allow mcp__playwright. The supplied settings also enable all project MCP servers. These changes alter an AI-agent control surface and permissions during dependency installation, while a managed gitignore block can conceal the installed configuration from normal version-control review.

AI rationale

This is a concrete unconsented install-time mutation of a consumer project's AI-agent configuration and MCP approval state. The optional dashboard request is separately gated, but it does not remove the install-hook control-surface risk.

Evidence

package.jsonbin/postinstall.jstemplates/settings.local.json.example.claude/skills.claude/commands.claude/settings.json.claude/settings.local.json

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/skills/k6-framework-scaffold/scaffold.shView file

291patternName = generic_password severity = medium line = 291

Medium

Secret Pattern

Package contains a possible secret pattern.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg · L291

•path = claude/skills/k6-framework-scaffold/scaffold.sh kind = build_helper sizeBytes = 15981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg

bin/postinstall.jsView file

20function ensureDir(dir) { L21: if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); L22: } ... L31: const isNew = !fs.existsSync(dest); L32: fs.copyFileSync(src, dest); L33: isNew ? log.added.push(rel) : log.updated.push(rel); ... L52: const skillsSrc = path.join(PACK_DIR, 'claude', 'skills'); L53: const skillsDest = path.join(PROJECT_ROOT, '.claude', 'skills'); L54: ... L60: if (fs.existsSync(destPath)) { L61: log.protected.push(path.join('.claude', 'skills', rel)); L62: return false; // never overwrite

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.jsView on unpkg · L20

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const localsettingsdest = path.join(project_root, '.claude', 'settings.local.json'); if (!fs.existssync(localsettingsdest)) { copyfile( path.join(pack_dir, 'templates', 'settings.local.json.example'), localsettingsdest, { overwrite: false } ); } copyfile( path.join(pack_dir, 'templates', 'settings.local.json.example'), path.join(project_root, '.claude', 'settings.local.json.example'), { overwrite: true } );

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @roopesh.yadava/qa-pack@1.6.2 matchedPath = bin/postinstall.js matchedIdentity = npm:QHJvb3Blc2gueWFkYXZhL3FhLXBhY2s:1.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView file

22const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: L25: const ROOT = process.cwd(); L26: ... L30: // the environment, and the pack ships no dotenv. Without this, every L31: // `process.env.QA_*` read below is permanently undefined and the features gated L32: // on them (report-run, token tracking) are silent no-ops no matter what the user ... L35: let raw; L36: try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; } L37: for (const line of raw.split(/\r?\n/)) { ... L65: if (raw === null) return fallback;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView on unpkg · L22

22const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: L25: const ROOT = process.cwd(); L26: ... L30: // the environment, and the pack ships no dotenv. Without this, every L31: // `process.env.QA_*` read below is permanently undefined and the features gated L32: // on them (report-run, token tracking) are silent no-ops no matter what the user ... L35: let raw; L36: try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; } L37: for (const line of raw.split(/\r?\n/)) { ... L65: if (raw === null) return fallback;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView on unpkg · L22