Loading npm security reports…

@roopesh.yadava/qa-pack@1.7.0: AI-agent control-surface risk | LPM Firewall

registry / @roopesh.yadava/qa-pack / 1.7.0

@roopesh.yadava/qa-pack@1.7.0

AI-powered QA agent skills for Claude Code — manual testing, BDD automation, accessibility, UI/Figma diff, bug reporting

AI Security Review

scanned 19d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package silently installs and updates agent skills and commands in the consumer project. It also changes agent permissions to auto-approve Playwright MCP and enables project MCP servers.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm installation or update runs postinstall automatically.

Impact

A package update can replace agent instructions and expand automated tool approval without an explicit user setup command.

Mechanism

Install-time mutation of the consumer project's Claude agent configuration and command surface.

Policy narrative

The package declares postinstall, so installation runs code in the consumer project. That code overwrites Claude skills and commands, creates local settings from a template that enables all project MCP servers, and forcibly adds Playwright MCP to the approval list even when the settings file already exists. It also maintains ignore rules for the installed files. This is an unconsented install-time expansion and persistence of an AI-agent control surface.

AI rationale

The automatic lifecycle script mutates a foreign project's Claude configuration and approval policy, including broad MCP enablement and automatic Playwright MCP approval. This is concrete install-hook abuse rather than a user-invoked setup flow.

Evidence

package.jsonbin/postinstall.jstemplates/settings.local.json.example.claude/skills/.claude/commands/.claude/settings.local.json.claude/settings.json

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

claude/skills/k6-framework-scaffold/scaffold.shView file

291patternName = generic_password severity = medium line = 291

Medium

Secret Pattern

Package contains a possible secret pattern.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg · L291

•path = claude/skills/k6-framework-scaffold/scaffold.sh kind = build_helper sizeBytes = 15981 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

claude/skills/k6-framework-scaffold/scaffold.shView on unpkg

bin/postinstall.jsView file

20function ensureDir(dir) { L21: if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); L22: } ... L31: const isNew = !fs.existsSync(dest); L32: fs.copyFileSync(src, dest); L33: isNew ? log.added.push(rel) : log.updated.push(rel); ... L52: const skillsSrc = path.join(PACK_DIR, 'claude', 'skills'); L53: const skillsDest = path.join(PROJECT_ROOT, '.claude', 'skills'); L54: ... L60: if (fs.existsSync(destPath)) { L61: log.protected.push(path.join('.claude', 'skills', rel)); L62: return false; // never overwrite

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/postinstall.jsView on unpkg · L20

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. const localsettingsdest = path.join(project_root, '.claude', 'settings.local.json'); if (!fs.existssync(localsettingsdest)) { copyfile( path.join(pack_dir, 'templates', 'settings.local.json.example'), localsettingsdest, { overwrite: false } ); } copyfile( path.join(pack_dir, 'templates', 'settings.local.json.example'), path.join(project_root, '.claude', 'settings.local.json.example'), { overwrite: true } );

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/postinstall.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @roopesh.yadava/qa-pack@1.6.2 matchedPath = bin/postinstall.js matchedIdentity = npm:QHJvb3Blc2gueWFkYXZhL3FhLXBhY2s:1.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView file

22const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: L25: const ROOT = process.cwd(); L26: ... L30: // the environment, and the pack ships no dotenv. Without this, every L31: // `process.env.QA_*` read below is permanently undefined and the features gated L32: // on them (report-run, token tracking) are silent no-ops no matter what the user ... L35: let raw; L36: try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; } L37: for (const line of raw.split(/\r?\n/)) { ... L65: if (raw === null) return fallback;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView on unpkg · L22

22const crypto = require('crypto'); L23: const { spawnSync } = require('child_process'); L24: L25: const ROOT = process.cwd(); L26: ... L30: // the environment, and the pack ships no dotenv. Without this, every L31: // `process.env.QA_*` read below is permanently undefined and the features gated L32: // on them (report-run, token tracking) are silent no-ops no matter what the user ... L35: let raw; L36: try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; } L37: for (const line of raw.split(/\r?\n/)) { ... L65: if (raw === null) return fallback;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

claude/skills/qa-agent/toolkit/qa-toolkit.cjsView on unpkg · L22