registry / AI-agent control-surface risk / @sallyhuang/agent-notify
@sallyhuang/agent-notify
Native macOS notifications for AI coding agents
This report shows the evidence for @sallyhuang/agent-notify@1.0.4. 5 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic postinstall mutation of broad, foreign AI-agent control surfaces is a concrete malicious install-hook abuse under the policy. The absence of visible credential theft does not neutralize that unconsented lifecycle behavior.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall during package installation
Impact
An install can introduce implicitly invokable agent instructions across Codex, Claude, Cursor, and generic agent skill surfaces without user setup consent.
Mechanism
Automatic global AI-agent skill installation and native app deployment
Policy narrative
When npm installs this package, its postinstall script deploys a native application and copies the packaged skill into four global AI-agent skill roots. The Codex skill allows implicit invocation, so the install changes multiple agent control surfaces without a separate user-directed setup action. Intel installations download and unpack a release archive before replacing the installed application.
AI rationale
The automatic postinstall mutation of broad, foreign AI-agent control surfaces is a concrete malicious install-hook abuse under the policy. The absence of visible credential theft does not neutralize that unconsented lifecycle behavior.
Evidence
package.jsonscripts/npm-install.jsskills/agent-notify/agents/openai.yamlskills/agent-notifyprebuilt/AgentNotify.app$HOME/Applications/AgentNotify.app$HOME/.agents/skills/agent-notify$HOME/.codex/skills/agent-notify$HOME/.claude/skills/agent-notify$HOME/.cursor/skills/agent-notify
Network endpoints1
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package automatically runs its installer through a postinstall lifecycle hook.
- The installer copies a skill into four global agent-control directories under the user's home directory without an explicit setup command.
- The installer replaces a home-directory app bundle and downloads an architecture-specific release archive before copying it into place.
- The installed Codex skill permits implicit invocation and supplies a default prompt.
Evidence against
- No source code reads environment secrets, credentials, or arbitrary user files.
- The only source-visible network target is the package's GitHub release URL.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
UrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/npm-install.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgbin/agent-notify.jsView file
4const path = require("path");
L5: const { spawnSync } = require("child_process");
L6:
High
Child Process
Package source references child process execution.
bin/agent-notify.jsView on unpkg · L4scripts/npm-install.jsView file
49if (architecture === "arm64" && fs.existsSync(path.join(bundledApp, "Contents", "MacOS", "AgentNotify"))) {
L50: fs.mkdirSync(path.dirname(appDestination), { recursive: true });
L51: fs.rmSync(appDestination, { recursive: true, force: true });
L52: fs.cpSync(bundledApp, appDestination, { recursive: true });
L53: console.log("Installed the bundled Apple Silicon AgentNotify.app.");
...
L66: if (!fs.existsSync(extracted)) throw new Error("release archive did not contain AgentNotify.app");
L67: fs.mkdirSync(path.dirname(appDestination), { recursive: true });
L68: fs.rmSync(appDestination, { recursive: true, force: true });
L69: fs.cpSync(extracted, appDestination, { recursive: true });
L70: } finally {
...
L76: const source = path.join(packageRoot, "skills", "agent-notify");
L77: for (con
Findings
1 Critical6 High4 Medium3 Low
CriticalAi Agent Control Hijackscripts/npm-install.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/agent-notify.js
HighSame File Env Network Executionscripts/npm-install.js
HighTrigger Reachable External Ai Agent Control Surface Mutationscripts/npm-install.js
HighKnown Malware Source Similarityscripts/npm-install.js
HighKnown Malware Source Fingerprint Signaturescripts/npm-install.js
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryprebuilt/AgentNotify.app/Contents/MacOS/AgentNotify
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @sallyhuang/agent-notify@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing @sallyhuang/agent-notify@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
5 known versions1.0.4latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 3:45 PM1.0.3MaliciousInstall Hook AbuseBlockPublishedSep 4, 2026, 7:00 AM1.0.2MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 4, 2026, 6:32 AM1.0.1MaliciousSoft block: AI-agent control surfaceBlock