Loading npm security reports…

@roopesh.yadava/qa-pack@1.6.2: AI-agent control-surface risk | LPM Firewall

registry / @roopesh.yadava/qa-pack / 1.6.2

@roopesh.yadava/qa-pack@1.6.2

AI-powered QA agent skills for Claude Code — manual testing, BDD automation, accessibility, UI/Figma diff, bug reporting

AI Security Review

scanned 29d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package mutates the consumer project's Claude control surface. It overwrites agent instructions, enables MCP execution, and deploys an instruction that posts test-charter data to a fixed endpoint.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm installation runs postinstall; subsequent Claude skill use follows the deployed instructions.

Impact

A consumer project can receive altered agent permissions and instructions that cause externally directed data transmission.

Mechanism

Install-time AI-agent configuration mutation and hardcoded remote posting instruction.

Policy narrative

During npm installation, the postinstall hook copies and overwrites Claude skills and commands in the consumer project, creates local settings, and forcibly adds an MCP permission. The installed settings enable project MCP servers. One deployed skill directs the agent to post full test-charter content and identity fields to a fixed external endpoint. This is an unconsented install-time mutation of a broad AI-agent control surface with a concrete downstream data-transfer path.

AI rationale

The automatic hook broadly modifies a foreign project's Claude configuration and agent instructions, including an MCP auto-approval rule. The hardcoded remote posting instruction makes the resulting control-surface change concrete rather than a benign local scaffold.

Evidence

package.jsonbin/postinstall.jstemplates/settings.local.json.exampleclaude/skills/test-charter/SKILL.md.claude/skills/

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/skills/k6-framework-scaffold/scaffold.shView file

•matchType = normalized_sha256 matchedPackage = @roopesh.yadava/qa-pack@1.6.1 matchedPath = claude/skills/k6-framework-scaffold/scaffold.sh matchedIdentity = npm:QHJvb3Blc2gueWFkYXZhL3FhLXBhY2s:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg

291patternName = generic_password severity = medium line = 291

Medium

Secret Pattern

Package contains a possible secret pattern.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg · L291

•path = claude/skills/k6-framework-scaffold/scaffold.sh kind = build_helper sizeBytes = 15981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg

bin/postinstall.jsView file

20function ensureDir(dir) { L21: if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); L22: } ... L31: const isNew = !fs.existsSync(dest); L32: fs.copyFileSync(src, dest); L33: isNew ? log.added.push(rel) : log.updated.push(rel); ... L52: const skillsSrc = path.join(PACK_DIR, 'claude', 'skills'); L53: const skillsDest = path.join(PROJECT_ROOT, '.claude', 'skills'); L54: ... L60: if (fs.existsSync(destPath)) { L61: log.protected.push(path.join('.claude', 'skills', rel)); L62: return false; // never overwrite

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.jsView on unpkg · L20

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const localsettingsdest = path.join(project_root, '.claude', 'settings.local.json'); if (!fs.existssync(localsettingsdest)) { copyfile( path.join(pack_dir, 'templates', 'settings.local.json.example'), localsettingsdest, { overwrite: false } ); } copyfile( path.join(pack_dir, 'templates', 'settings.local.json.example'), path.join(project_root, '.claude', 'settings.local.json.example'), { overwrite: true } );

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @roopesh.yadava/qa-pack@1.6.1 matchedPath = bin/postinstall.js matchedIdentity = npm:QHJvb3Blc2gueWFkYXZhL3FhLXBhY2s:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView file

22const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: L25: const ROOT = process.cwd(); L26: ... L30: // the environment, and the pack ships no dotenv. Without this, every L31: // `process.env.QA_*` read below is permanently undefined and the features gated L32: // on them (report-run, token tracking) are silent no-ops no matter what the user ... L35: let raw; L36: try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; } L37: for (const line of raw.split(/\r?\n/)) { ... L65: if (raw === null) return fallback;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView on unpkg · L22

•matchType = normalized_sha256 matchedPackage = @roopesh.yadava/qa-pack@1.6.1 matchedPath = claude/skills/qa-agent/toolkit/qa-toolkit.cjs matchedIdentity = npm:QHJvb3Blc2gueWFkYXZhL3FhLXBhY2s:1.6.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView on unpkg

22const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: L25: const ROOT = process.cwd(); L26: ... L30: // the environment, and the pack ships no dotenv. Without this, every L31: // `process.env.QA_*` read below is permanently undefined and the features gated L32: // on them (report-run, token tracking) are silent no-ops no matter what the user ... L35: let raw; L36: try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; } L37: for (const line of raw.split(/\r?\n/)) { ... L65: if (raw === null) return fallback;