registry / @sallyhuang/agent-notify / 1.0.0

@sallyhuang/agent-notify@1.0.0

Native macOS notifications for AI coding agents

AI Security Review

scanned 4h ago · by lpm-firewall-ai

npm postinstall fetches an unverified remote application archive and installs it in the user's Applications directory. It also adds behavior-bearing skills to several AI-agent control surfaces without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Installing the npm package with lifecycle scripts enabled.

Impact

A package install can replace a user app and cause multiple AI coding agents to load the supplied skill.

Mechanism

Postinstall remote binary installation and broad AI-agent skill deployment.

Attack narrative

Installing the package triggers postinstall. The script obtains a release archive from GitHub, extracts it with a system tool, deletes any existing AgentNotify.app, and copies in the downloaded app. It then installs the bundled skill into global skill locations for several unrelated AI-agent products. This creates unconsented, install-time mutation of broad agent control surfaces.

Rationale

The automatic lifecycle script both installs an unverified remote executable and writes behavior-bearing configuration into multiple foreign AI-agent directories. This is concrete install-hook abuse under the stated policy.

Evidence

package.jsonscripts/npm-install.js~/Applications/AgentNotify.app~/.agents/skills/agent-notify~/.codex/skills/agent-notify~/.claude/skills/agent-notify~/.cursor/skills/agent-notify

Network endpoints1

/sally1913105/AgentNotify/releases/download/${releaseTag}/${asset}

@sallyhuang/agent-notify@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code